Revoke an API key

Scope: keys (always opt-in). Scoped to the CALLING key's mode: a sandbox key cannot revoke a live key. A cross-mode id yields no rows and returns 404 exactly like an unknown id, so it cannot be used to probe for the existence of live keys. A key-store outage returns 503 DB_UNAVAILABLE with Retry-After rather than a bare 500.