Immediately invalidate a login token, ahead of its natural 10-day expiry.

Use this when a token has leaked, an integration is being rotated, or a session should be terminated. From the moment this call returns, the revoked token is rejected by every endpoint.

Rules:

• The bearer token you authenticate with must be minted for the organisationId in the URL and carry the CRM_ADMIN, ACCOUNT_OWNER, or CRM_BOT role.
• The token being revoked must also belong to that organisation — you cannot revoke another organisation's tokens.
• Revoking the token you are authenticating with (self-logout) is allowed.
• Revocation is permanent and idempotent; mint a replacement via POST /token.
• Tokens issued before revocation support cannot be revoked individually — they expire on their own within 10 days of issue.