Add IndieAuth token introspection endpoint (RFC 7662)

Lets a resource server (or a client checking its own token, via
self-introspection) verify a token's active/me/client_id/scope without
needing to be tightly coupled to this token endpoint. Requires the
caller to present their own currently-active token as authorization,
per spec's requirement that the endpoint MUST require some form of
authorization. Inactive tokens get back only {"active": false}, no
detail on why, matching the privacy stance already used for
revocation.

Pulled the hash-and-lookup-active-token logic (now needed a third
time) into MicropubToken::findActive(), used by this, the revocation
endpoint, and VerifyMicropubToken.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014625MfkGZ7GVdbqKme4a8L

app/Http/Middleware/VerifyMicropubToken.php

@@ -35,9 +35,7 @@ class VerifyMicropubToken
             ], 401);
         }
 
-        $token = MicropubToken::where('token_hash', hash('sha256', $rawToken))
-            ->whereNull('revoked_at')
-            ->first();
+        $token = MicropubToken::findActive($rawToken);
 
         if (! $token) {
             $micropubResponses = new MicropubResponses;