Token revocation endpoint

Unauthenticated by design: the connection code IS the credential, which is what lets the agent app have no sign-in screen at all. Returns a long-lived per-device secret, shown ONCE, which the device then presents to mint short-lived WebRTC tokens and to heartbeat presence. Every failure except a full line answers `devices.code_invalid` without saying why — distinguishing expired from unknown from already-used would turn this into an oracle for whether six digits ever existed.