fix(security): reject an access token once its shared session is gone

AccessTokenValidator only checked signature/exp/issuer, so a token revoked
via Auth's /revoke kept working everywhere else (Gateway's scope check,
every service's Identity) until its own exp — /revoke had no effect
outside Auth's own /userinfo. It now also requires a live session for the
token's jti in the shared identity_session Redis pool.

SessionWriter gains delete(), the write-side counterpart Auth's
RevokeController needs to actually evict a session instead of only
recording revocation somewhere nothing else reads.