Replace JWT Micropub tokens with revocable opaque tokens

Tokens now store a hashed row in micropub_tokens instead of being
self-contained signed JWTs, so a leaked or unwanted token can actually
be revoked. Since revocation already requires a DB lookup on every
request, JWT's stateless-verification benefit was gone anyway, so this
also drops the lcobucci/jwt dependency entirely.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014625MfkGZ7GVdbqKme4a8L

database/migrations/2026_08_13_120924_create_micropub_tokens_table.php

@@ -0,0 +1,30 @@
+<?php
+
+declare(strict_types=1);
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::create('micropub_tokens', function (Blueprint $table) {
+            $table->id();
+            $table->string('token_hash')->unique();
+            $table->string('client_id');
+            $table->string('me');
+            $table->string('scope');
+            $table->timestamp('revoked_at')->nullable();
+            $table->timestamps();
+
+            $table->index('client_id');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('micropub_tokens');
+    }
+};