Revoke a per-user-headers credential

Hard-deletes a per-user-headers credential row by primary key. Authorization scoping is enforced server-side — callers may only delete credentials visible to their identity.

The unified DELETE /api/mcp/sessions/{id} is the more convenient entry point; this typed endpoint exists for callers that already know they're acting on a header credential row.