Token revocation: model the OAuth endpoints, or bring revokeToken to every SDK #276

Kotlin gained HeyClient.revokeToken in #270: DELETE /oauth/tokens, unsigned, following no redirect. It is hand-written, like the token exchange and refresh in Go, Rust and TypeScript, because the OAuth endpoints sit outside the API the Smithy model describes (scripts/drift-check-reverse filters ^/oauth).

That leaves two questions:

1. Should the OAuth server be modelled? If /oauth/authorizations, /oauth/tokens (POST and DELETE) were in the spec, the hard rules (generated methods, route table, conformance in every SDK) would cover them, instead of each SDK carrying its own copy. The cost is that the model has to express what makes these requests unlike the API's: form bodies, no .json suffix, unsigned, no redirect, and no refresh on a 401.
2. Until then, revocation exists only in Kotlin. Go, Rust, Swift and TypeScript have no way to revoke a token on sign-out. A shared conformance case would pin the contract Kotlin already tests: the token goes in the form body, never the query; no Authorization or DPoP header; a 3xx is the answer and is never followed; a 401 is not refreshed; 200 {} for an unknown token; invalid_client for another app's token.

Either answer works. The second can go ahead without the first, and the first would replace it.