oauth2-session: tombstone revoked refresh families instead of deleting them #1256

Roadmap step 2 (M1). Audit finding F-F2.

Current state

revoke_refresh_token_family_impl (crates/oauth2-session-driver-raft/src/lib.rs:336-355) removes every token and index entry in the family. After a reuse-detection breach (crates/core/src/oauth2_session/service.rs:336-345) there is no record of which tokens existed, when they were minted, or from which client, so post-incident forensics has nothing to correlate the critical CADF event against.

What must be done

• Add revoked_at: Option<i64> and revocation_reason: Option<String> (reuse_detected, client_revoked, user_disabled, user_deleted, domain_disabled, operator, rp_revoke) to RefreshToken in crates/core-types/src/oauth2_session/resource.rs, with #[serde(default)] for on-disk compatibility.
• Change revoke_refresh_token_family to stamp every member instead of deleting; keep the family index so the janitor (step 3) can purge after expires_at + retention.
• In Oauth2SessionService::redeem_refresh_token, treat revoked_at.is_some() as RefreshTokenRedemption::Invalid before the spent_at branch, so presenting a token from an already-revoked family does not re-trigger the breach cascade or a second critical audit event.
• Extend RefreshTokenRedemption (or the audit call site in token.rs) so the reason is available for the emit_oauth2_refresh_reuse_critical_event attachment.
• Unit tests in service.rs: revoked family returns Invalid without calling revoke_refresh_token_family again; tombstones carry the reason.
• Update tests/integration/src/oauth2_session.rs test_authorization_code_flow_and_refresh_reuse_collapses_family to assert the tombstone rather than absence.