#223 Revoke the token fizzy signup created when logging out

Summary

fizzy signup creates a write token ("Fizzy CLI") for the account it sets up. Until now fizzy auth logout only forgot it, so the token stayed valid at Fizzy until someone revoked it by hand. Logout now revokes that token first, then removes it as before.

• Only the CLI's own token. A token given to fizzy auth login is still only removed. It may also live in a password manager, CI or another tool, so it isn't the CLI's to revoke. The help text says so.
• How the CLI knows which token it created. saveSignupConfig records the token's SHA-256 (never the token) under the profile's minted_token_sha256. Any other save through saveProfileCredentialState, such as auth login, drops that mark. Logout revokes only a stored token whose digest matches. A stale mark next to a different token matches nothing, so a pasted token is never revoked, whichever path stored it.
• Best effort, reported. The request is POST <profile base URL>/oauth/revocation (RFC 7009), with a 10 s timeout and no redirects followed. Fizzy accepts a personal access token there on possession and answers 200. Any other answer, or no answer, still removes the credential, prints a warning on stderr pointing at Fizzy's access tokens, and sets revoke_error. The result now carries revoked: true|false. --all does the same for every profile.

Compatibility

• Profiles and tokens saved by earlier versions have no mark, so logging out of them behaves exactly as before: the token is only removed.
• A server without /oauth/revocation (404) or with an outage means a local logout plus the warning.
• Older CLIs ignore the extra profile key.

Tests

• internal/commands/minted_token_test.go:
  • a signup token is revoked (once, at the profile's base URL) and removed, and the profile holds the digest, not the token;
  • three cases make no request: a pasted token, a signup token replaced by a login, and a stale mark beside a pasted token;
  • a 500 or 404 still removes the token, warns, and reports revoked: false with the error and no token in it;
  • --all revokes both signup tokens and not the pasted one.
• Mutation checks:
  • dropping the digest comparison fails the stale-mark case;
  • stubbing out the revocation fails the revoke and failure cases.
• make lint, go vet ./..., gofmt -l . and go test -race ./internal/commands/ pass, as does go test ./....

---

Summary by cubic

fizzy auth logout now revokes the write token that fizzy signup created before removing it, so the token no longer stays valid at Fizzy. Tokens handed to fizzy auth login are still only forgotten, never revoked, since they may be in use elsewhere.

• The CLI records which token signup created by its SHA-256 in the profile (never the token itself); any other save drops that mark, so a pasted token is never revoked.
• Revocation is best effort and bounded: if Fizzy doesn't confirm it, the credential is still removed locally with a stderr warning printed before cleanup. revoked is true only when every due revocation, including each in --all, went through; any failure reports revoked: false with revoke_error naming the profile. All revocations in one logout share a 20 s deadline. When the credential store can't be read, the fallback config-file token is matched and revoked if it belongs to signup; otherwise an unreadable store counts as a failed revocation, as does a signup token the profile no longer stores, which may still be live.
• Profiles saved by earlier versions carry no mark, so logging out of them behaves exactly as before.