Revokes an access token or a refresh token, per OAuth 2.0 RFC 7009.

Both token planes are supported. RFC 7009 §2 makes refresh-token revocation the
mandatory half. A JWT access token is blacklisted by its jti until it expires; an
opaque refresh token is deleted outright. The optional token_type_hint only
reorders the search and never ends it (§2.1), so a wrong hint still revokes; an
unrecognized or empty hint is treated as absent and is never an error.

Authorization is OWNERSHIP, not a scope. Any authenticated caller may reach this
endpoint, and may revoke only a token issued to itself (§2.1). A token belonging to
another principal is silently left alone — including for a platform administrator, who
gains no privilege here. DELETE /api/v3/auth/token/s/{tokenId} remains the only
administrative revocation path.

Request format — application/x-www-form-urlencoded, as RFC 7009 §2.1 specifies.
A JSON body is answered 400 carrying the RFC 6749 §5.2 error object, not 415 — see
the 400 response below.

Outcomes — per §2.2 the response is 200 with an empty body when the token was
revoked, was already gone, never existed, was not the caller's, or was not parseable.
These are byte-identical on purpose: a distinguishable refusal would let any caller use
this endpoint to discover whether a token value exists and whom it belongs to.

The one exception is 503, returned when the revocation store is unavailable. RFC
7009 §2.2: on a 503 the client must assume the token still exists. It is decided before
any per-token outcome is known, so it discloses nothing — and answering 200 there would
report a revocation that did not happen.