fix(auth): persist API key revocations beyond the one-hour TTL

[lienhoatienphung-svg]

Closes #1242

Summary

Removes the 1-hour default TTL fallback on API key revocations in TokenRevocationService (src/services/tokenRevocation.ts) so revocations without an explicit positive expiresAt persist indefinitely (expiresAt: null), adds createApiKeyRepository(backingRecords) and isRevokedByHash in src/repositories/apiKeyRepository.ts, and checks both the in-memory revocation service and repository backing store in src/routes/gatewayRoutes.ts.

Acceptance Criteria Mapping

• A revoked key is rejected 2 hours later under fake timers: Verified in src/services/tokenRevocation.test.ts and src/middleware/gatewayApiKeyAuth.test.ts.
• A revoked key is rejected after a simulated process restart (new repository instance): Verified in src/middleware/gatewayApiKeyAuth.test.ts.
• Two gateway instances sharing the same database see revocations from the other: Verified with two repository/gateway instances sharing a backing store in src/middleware/gatewayApiKeyAuth.test.ts.

Validation

• npx jest src/services/tokenRevocation.test.ts src/middleware/gatewayApiKeyAuth.test.ts --no-cache (all 44 tests pass).

---

Payout Wallet (Base Mainnet USDC / EVM): 0x3806cd592a508d1992Ed007C2F53de251C2E7452