Reports whether a token is currently active, per OAuth 2.0 RFC 7662.

What active means (RFC 7662 §2.2) — the token was issued by this authorization
server, has not been revoked, and is within its validity window. That is the whole
determination. The token's aud is reported in the response and takes part in no
decision: this service issues several audiences (ankasecure-admin for human users,
ankasecure-core for application actors), and all of them introspect identically.

Both token planes are searched. The value may be a JWT access token or an opaque
refresh token. Per RFC 7662 §2.1 the optional token_type_hint only reorders the
search — it never ends it, so a wrong hint still finds the token. An unrecognized or
empty hint is treated as absent and is never an error.

Request format — application/x-www-form-urlencoded, as RFC 7662 §2.1 specifies.
A JSON body is answered 400 carrying the RFC 6749 §5.2 error object, not 415 — see
the 400 response below.

Authorization — requires platform.token.read (all tenants; restricted to
PRIVATE_CLOUD and ON_PREMISE deployments) or auth.tenant.token.read (the caller's own
tenant, in every deployment mode).

Disclosure — an inactive token yields {"active": false} and nothing else: no
claims, and no distinction between expired, revoked, belonging to another tenant, and
never having existed. A token belonging to another tenant is reported inactive rather
than refused, because a 403 would confirm the token exists while declining to
describe it.