Mounted inside bearerAuth so the JTI is already validated. Revokes the access JTI in abs_sessions and returns 204. Idempotent: re-calling on an already-revoked JTI still returns 204. Refresh JTI is intentionally NOT revoked here — clients that want hard sign-out-everywhere will use the sessions endpoint added in Phase 3. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>