feat(permissions): revocable and per-repository tokens #34

Scoped tokens are stateless and signed. That keeps them cheap, but:

• they can't be revoked before they expire;
• a token works on every repository of the server that issued it;
• they last at most 7 days, so a long-lived worker needs a fresh token regularly.

Options include a revocation list keyed by token id, binding a token to a repository, and longer-lived tokens once they can be revoked.