Revoke an API token immediately

Immediately revokes an API token ("Revoke" / "Revoke token" in the UI). The token's status transitions to REVOKED, the credential stops authenticating at once — any client still using it starts receiving 401 immediately — and the record remains visible in the token list and audit trail for traceability. Revocation is permanent and cannot be undone; a replacement token must be created if access is needed again. Validation: the token must exist and be visible in the active scope (NOT_FOUND otherwise); the current status must permit revocation — an already REVOKED token is rejected with CONFLICT (409), while revoking an EXPIRED token is also a state conflict; the caller must hold a token-management role (owner|admin|contributor) or the request fails with FORBIDDEN. Async & state: Synchronous command returning 200 with the updated token (ACTIVE/EXPIRED → REVOKED, terminal). A resource.updated SSE frame with kind: iam.api_token carries a patch containing the new status so open list and detail views refresh. Errors: 401 unauthenticated; 403 caller lacks token-management permission; 404 unknown or out-of-scope token; 409 token already revoked or otherwise in a state that does not permit revoke; 500 on backend failure. Idempotency/Concurrency: Supply Idempotency-Key; a replay with the same key returns the original 200 result without reprocessing. This operation does not check If-Match; a sent one is ignored.