Revoke tokens by OAuth client ID

[swalker326]

Migrated from anomalyco/openauth#131 — original issue by @nlebedevinc. 8👍 upstream.

Request

Add the ability to revoke all tokens/refresh tokens associated with a particular OAuth client_id.

Motivation (from upstream)

Revoking tokens by OAuth client ID is critical for scenarios such as:

1. Decommissioning an OAuth client
2. Managing compromised client credentials
3. Enforcing stricter security policies (e.g. force re-login for a specific integration)

Currently there is no direct way to revoke all tokens for a client — only subject-level invalidation exists (ctx.invalidate(subject)).

Design sketch

• Something like revokeClient(clientID) on the issuer auth context, or an admin endpoint
• Implementation can build on the existing refresh-token storage: scan/delete refresh token records keyed by client, so subsequent refresh() calls fail and access tokens (short-lived JWTs) die out naturally
• Pairs well with anomalyco/openauth#249 (refresh revocation hook)