Refuse a blank grant ref or Bot on revoke, like grant does

[Ayush7614]

What this changes

Fixes #495. The twin-endpoint inconsistency on the same file:

• DELETE /api/plugins/grants checked if (!kind || !ref || !agentId). Query params are always strings and " " is truthy, so ?ref=%20%20 skipped the 400, deleted zero rows by exact match, still wrote a plugin_revoked audit row naming whitespace, and answered 200 {ok:true}.
• POST /grants already requires typeof === "string" && .trim() with "A kind, a ref and a Bot are required.". DELETE requires the same now and acts on the trimmed values, so surrounding whitespace on a real ref/Bot still revokes what the caller meant.

Where it runs

Stateless request validation in the server process. Same 400 on every replica.

• New state that outlives a request? None. Per-request validation.
• What happens on the second replica? Same 400/200 on every server: pure function of the query string. The existing revoke path (exact-match delete + audit row) is unchanged for valid input.
• Anything serialised? No.
• Anything fanned out to a browser? No.
• New listener, port, or schedule? No.

Postgres is already there and is the default answer to all of the above: nothing here needs it.

Boundary and audit

• Every acting call still goes through the gateway: resolve, decide, audit, then act. This checks well-formedness only; enablementRefusal ordering is untouched.
• New refusals and new failures each write a row. The 400 path writes none (no delete happened, matching POST); valid revokes still write their row exactly as before.
• Nothing new is trusted from the client that the server can resolve itself. Stricter: blank refs never reach the store.

Changelog

• A line in CHANGELOG.md under Unreleased: grant revoke validation entry.

Proof

• bun test server/tests/plugin-grants-validation.test.ts: 16 pass (6 existing POST grants + 4 existing call + 5 new DELETE refusal cases incl. whitespace ref/agentId and missing params + 1 valid revoke proving trimmed values still delete).
• bun test server/tests/plugin-grants-validation.test.ts server/tests/plugin-routes.test.ts: 31 pass, 0 fail.
• bunx biome format + bunx biome lint --error-on-warnings on touched files: clean.
• bunx tsc --noEmit -p server/tsconfig.json: only the 3 pre-existing copilot.ts missing-module errors, identical on clean upstream main; nothing in touched files.

[davidmckayv]

Verified: bug reproduced against main, fix confirmed, tests pass, CI green.

[davidmckayv]

Bug reproduced against main, fix verified, tests pass; rebase was CHANGELOG-only on validated substance.