feat: revoke tokens server-side on auth logout (best-effort RFC 7009)

[nycomp]

Summary

campus auth logout now attempts server-side token revocation (RFC 7009) before clearing local credentials. Previously it only deleted the local keyring/file entries, leaving the refresh token valid on the auth server until natural expiry — a copied or stolen token survived logout entirely.

Found during the 2026-10-01 auth posture review of campus-cli.

Design decisions

• Revokes refresh token first, then access token (RFC 7009 token_type_hint on each), both bound to client_id=guest (public client — no secret).
• Best-effort, never fatal: any failure (network error, non-200, endpoint not deployed) degrades to a local-only logout with a single dim note: "server-side token revocation was unavailable; local credentials were cleared." Offline logout works.
• The logged-out no-op path makes no network calls (preserves PR fix: make auth logout a friendly no-op when not logged in #10's friendly no-op and keeps it offline).
• Timeout is 10s per call so logout stays bounded.

Server-side prerequisite

The auth server has no revocation endpoint today — POST /auth/v1/oauth/revoke returns 404 on dev (probed 2026-10-01). Until it ships, every logout shows the dim note and clears locally; once it lands, revocation activates with no CLI change. Tracked as nyjc-computing/campus#677 (implementation notes for the server side are in that issue).

Related upstream issues filed from this review:

• auth: refresh_token grant not implemented — CLI auto-refresh fails against deployed dev server campus#678 — refresh_token grant not implemented on the deployed dev server (discovered while probing for this PR): CLI auto-refresh/campus auth refresh fail live today; tokens are effectively single-use until re-login. No CLI change needed; the CLI honors rotation already.
• campus-cli: bind stored credentials to their issuing auth endpoint (per-environment mismatch check) #18 — credential↔endpoint binding (transferred from nyjc-computing/campus#675) and campus-cli: surface the target auth endpoint now; flip default from development to production when prod exists #19 — the dev-default flip (from nyjc-computing/campus#676): not part of this PR.

Doc refresh (included)

• docs/PRD.md: logout line and a new Logout section (best-effort RFC 7009 semantics); corrected the stale "Configurable API endpoint" line (flag removed in PR chore: CLI polish — surface device-code error detail, remove unwired --api-endpoint flag #11) to describe the actual CAMPUS_AUTH_URL/config/default resolution.
• campus_cli/auth/login.py: corrected the stale CAMPUS_ENV docstring on auth login (the actual variable is CAMPUS_AUTH_URL).

Test plan

• 3 new unit tests for revoke_token: RFC 7009 payload + 200→True, non-200→False, network error→False (84 total, all passing).
• 2 new/updated integration tests: logout calls revocation with the stored tokens (refresh first, then access) and still clears local state when revocation fails; the not-authenticated no-op asserts no revocation call.
• ruff check clean; pre-commit smoke and pre-push lint hooks pass.

Verification note

Not exercised against the live dev server (a real logout would revoke the developer's stored token); behavior is pinned by the mocked tests above, and the live 404/no-endpoint path is exactly what the degradation tests simulate.