Revoke a key immediately

Revokes the selected key (UI "Revoke" in the Keys tab). Revocation is immediate and irreversible: the key's status becomes revoked, clients still presenting it fail authentication, and per the key-hygiene panel any tokens already issued with it expire within one hour. The UI toast warns "Key … revoked — clients using it will fail". A revoked key remains listed for audit purposes but exposes no further actions. Validation: the service account and key must exist and be visible in the scope (else 404 NOT_FOUND); the key's current state must permit revoke — a key already revoked is rejected → 409 CONFLICT; caller must hold a key-management role (owner|admin) else 403 FORBIDDEN. Async & state: Synchronous command — 200 with the key in its terminal revoked state. The key's private-key secret is purged from the secret store so it can never authenticate again; the revoked key stays listed for audit and the account's keyCount/oldestKeyAgeDays counters update immediately. Errors: 401 unauthenticated; 403 lacks key-management permission; 404 unknown account or key; 409 CONFLICT when the key is already revoked; 500 revocation failure. Idempotency/Concurrency: Idempotency-Key is optional; when sent it is reserved atomically (single-winner) — replaying the same key returns the original 200 result rather than a 409, making UI retries safe.