Revoke delegated access and refresh tokens

Requires registered public client_id plus token possession. Matching access or refresh token revokes its entire grant. Unknown tokens return the same empty 200 response, including tokens belonging to another client. Existing bt_ and svc_ credentials are unaffected. Authorization headers are rejected.

Response headers:

• Cache-Control (200).
• Referrer-Policy (200).
• Pragma (200).