Add IndieAuth token introspection endpoint (RFC 7662)

Lets a resource server (or a client checking its own token, via
self-introspection) verify a token's active/me/client_id/scope without
needing to be tightly coupled to this token endpoint. Requires the
caller to present their own currently-active token as authorization,
per spec's requirement that the endpoint MUST require some form of
authorization. Inactive tokens get back only {"active": false}, no
detail on why, matching the privacy stance already used for
revocation.

Pulled the hash-and-lookup-active-token logic (now needed a third
time) into MicropubToken::findActive(), used by this, the revocation
endpoint, and VerifyMicropubToken.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014625MfkGZ7GVdbqKme4a8L

app/Models/MicropubToken.php

@@ -25,6 +25,20 @@ class MicropubToken extends Model
         $this->forceFill(['revoked_at' => now()])->save();
     }
 
+    /**
+     * Find the active (non-revoked) token matching a raw bearer token string.
+     */
+    public static function findActive(string $rawToken): ?self
+    {
+        if ($rawToken === '') {
+            return null;
+        }
+
+        return self::where('token_hash', hash('sha256', $rawToken))
+            ->whereNull('revoked_at')
+            ->first();
+    }
+
     protected function isRevoked(): Attribute
     {
         return Attribute::make(