[0.7] A2A cascade revocation

[Raulgooo]

Release

0.7 — A2A Auth Layer

Objective

Revoke A2A token → all downstream A2A calls fail.

Problem

• A2A revocation doesn't cascade
• Downstream calls succeed after upstream revoked

Fix

1. POST /authority/revoke handles A2A tokens
2. Mark revoked in graph
3. Invalidate all downstream tokens
4. Immediate effect

Files

• internal/api/authority_handlers.go
• internal/storage/delegation.go
• internal/storage/tokens.go

Acceptance Criteria

• A2A revocation cascades
• Downstream calls fail immediately
• Graph shows revoked status
• Audit log
• SDK: shark.authority.revokeA2A(id)