Auth Jwt Revoke Create

Per-token revocation — Phase 7 of the staff step-up auth rollout.

Stateless JWT auth means the natural exp is the only kill switch by default. This view writes a Redis denylist key for the supplied jti so the next time the auth class sees that token, it raises AuthenticationFailed instead of accepting it. The TTL is bounded by the access-token lifetime so the denylist never grows unbounded.

Authorization:

• jti matches the caller's PRESENTED token: always allowed (self-revoke / logout-like — kill my current session NOW).
• jti is a DIFFERENT token: requires staff_write scope. Admin emergency revocation — used when a colleague's JWT is confirmed compromised. The actor's own session is unaffected.

The OLD JWT's cryptographic validity is unchanged — denylist is a server-side gate. A token presented after revocation fails KeywordsAIJWTAuthentication.authenticate with a 401.

See implementation_logs/security/staff_step_up_auth_design.md §7b.