Finish revoking a device, instead of half of it

ForgetDeviceAsync stopped this machine unlocking without a passphrase and left
the server's row exactly where it was, so the account went on listing a device
nobody could account for. ADR 0007 recorded that as a deliberate gap needing an
endpoint. This is the endpoint, and the two things that turned up behind it.

DELETE /api/v1/me/devices/{id}. The device row is not the dangerous half: a
kind=device wrap is the user's identity bundle sealed to a key somebody may be
holding, and that is what has to go. It goes on the foreign key's cascade rather
than a second statement, and RevokeDevice_TakesItsWrapWithIt asserts the cascade
rather than trusting the configuration to keep saying so.

Scoped to the caller's own account, which is the only authorisation check there
is. The id is an unguessable v7 GUID, but unguessable is not a permission —
without the scope one user could withdraw another's device key by pasting an id
they saw once, and the victim's next launch would ask for a passphrase with no
explanation. 404 rather than 403 for somebody else's device, so a stranger does
not learn the id exists.

Never refused for being the last device. ADR 0001 makes an enrolled device a
recovery path, so removing the last one does cost the user something — but the
machine being revoked is most likely the one they have just lost, and a server
that argued about it would be refusing the one request that has to work
immediately. The passphrase wrap is untouched either way, which
RevokeDevice_LeavesThePassphraseWrapAlone pins.

--- Two things found on the way ---

Registering twice from one machine left two devices on the account. The server
is idempotent on the public key, but the client generates a fresh key pair every
call and the keystore holds one — so the second registration orphaned a wrap
whose private half had just been overwritten, which is precisely the leftover
this change exists to remove. Registering now withdraws the previous device.
Found by a test that asserted the property and failed.

And the fakes were lying about it. FakeAccountServer's comment claimed the real
service's idempotence while handing back a fresh Guid on every call, which is
invisible until something revokes by id — at which point a test would be
revoking an id the server never issued, and passing. Both fakes now issue one id
per public key and drop the wrap with the device, as the cascade does.

--- Reachable at all ---

ForgetDeviceAsync had exactly one caller and it was a test, so "Stop unlocking
here" now sits in the account bar where "Use Windows Hello here" was. Its own
flag rather than the negation of that one: a machine with no TPM and a machine
that is already registered are both "cannot register", and only the second has
anything to take back.

No confirmation prompt, deliberately. The cost of pressing it by accident is one
passphrase and one re-registration; the cost of a dialog is a moment's
hesitation at the point somebody has realised a machine is in the wrong hands.

Offline it does the local half and says so rather than refusing. Whether this
machine may unlock itself is decided entirely by the local cache and the local
keystore — the unlock path never asks the server — so forgetting here is what
actually revokes, and "you are offline, so this machine will go on unlocking
itself" would be the worst available answer. DeviceRevocation.LocalOnly is what
the interface reports and the status line explains what is left to do.

The local half runs first for the same reason, and the keystore call is the
first thing in the method that can yield: on Windows it raises a consent dialog,
and a dialog wants the thread it was called from. That ordering is currently
load-bearing and shakier than it looks — see the open device-unlock hang.

Four mutations, all caught: dropping the user scope from the server query
(1 test), skipping the stale-device revoke on re-registration (2), skipping the
server call in ForgetDeviceAsync (2), and the earlier version of the client that
never called it at all.

930 tests green across 16 projects, 13 of them new. Zero warnings, format clean.

src/DodoSSH.Client.Session/VaultSession.cs

@@ -206,10 +206,24 @@ public sealed class VaultSession : IAsyncDisposable
             CryptographicOperations.ZeroMemory(privateKey);
         }
 
+        // Read after the keystore write, not before, so that write stays the first thing in this method that
+        // can yield. On Windows it raises a consent dialog, and a dialog wants the thread it was called from.
+        var previousDeviceId = (await Unlock.ReadAsync(cancellationToken).ConfigureAwait(false))?.DeviceId;
+
         var registered = await api
             .RegisterDeviceAsync(new RegisterDeviceRequest(deviceName, publicKey, wrap), cancellationToken)
             .ConfigureAwait(false);
 
+        // A machine is a device, so registering again replaces rather than adds. The server is idempotent on
+        // the public key, but this generates a fresh key pair every time and the keystore holds one — so a
+        // second registration would leave the account listing a device whose private half has just been
+        // overwritten. That row is not merely untidy: its kind=device wrap is the identity bundle sealed to a
+        // key that no longer exists anywhere, which is precisely the leftover revocation exists to remove.
+        if (previousDeviceId is { } stale && stale != registered.DeviceId)
+        {
+            await api.RevokeDeviceAsync(stale, cancellationToken).ConfigureAwait(false);
+        }
+
         await Unlock.AttachDeviceAsync(registered.DeviceId, wrap, cancellationToken)
             .ConfigureAwait(false);
 
@@ -217,23 +231,67 @@ public sealed class VaultSession : IAsyncDisposable
     }
 
     /// <summary>
-    /// Withdraws this machine's device key, locally.
+    /// Withdraws this machine's device key, here and on the account.
     /// </summary>
+    /// <param name="api">The server, or null when there is none to reach.</param>
+    /// <param name="deviceKeys">This machine's keystore.</param>
+    /// <param name="cancellationToken">Cancellation.</param>
+    /// <returns>How far the withdrawal got.</returns>
     /// <remarks>
-    /// Deliberately incomplete, and the gap is recorded rather than papered over: the server's wrap row
-    /// survives this, so the account will go on listing a device that can no longer unlock. Deleting it
-    /// needs an endpoint that does not exist yet. Until then the honest half is this one — the machine stops
-    /// being able to unlock without a passphrase, which is what a user asking to turn it off means.
+    /// <para>
+    /// <b>The local half first, and it is the half that matters.</b> Whether this machine may unlock without
+    /// a passphrase is decided entirely by what is in the local cache and the local keystore — the unlock
+    /// path never asks the server — so forgetting here is what actually revokes. Doing it first also means a
+    /// server call that fails cannot leave the machine still able to let itself in.
+    /// </para>
+    /// <para>
+    /// The server row is not bookkeeping, though, which is why this no longer stops at the local half. A
+    /// <c>kind=device</c> wrap is the user's identity bundle sealed to a key that may be in somebody else's
+    /// laptop; leaving it there means a machine that is wiped and reinstalled can pull the wrap down again,
+    /// and it means the account goes on listing a device nobody can account for.
+    /// </para>
+    /// <para>
+    /// Offline still does the local half and says so, rather than refusing. Somebody revoking a device
+    /// usually has a reason to want it gone <em>now</em>, and "you are offline, so this machine will go on
+    /// unlocking itself" is the worst of the available answers. <see cref="DeviceRevocation.LocalOnly"/> is
+    /// what the interface reports, and it is a state the user can act on by trying again online.
+    /// </para>
+    /// <para>
+    /// The device id is read from the store rather than from <see cref="Profile"/>, which is a snapshot taken
+    /// when the session opened and does not know about a device registered since.
+    /// </para>
     /// </remarks>
-    public async Task ForgetDeviceAsync(IDeviceKeyStore deviceKeys, CancellationToken cancellationToken)
+    public async Task<DeviceRevocation> ForgetDeviceAsync(
+        IAccountApi? api,
+        IDeviceKeyStore deviceKeys,
+        CancellationToken cancellationToken)
     {
         ObjectDisposedException.ThrowIf(disposed, this);
         ArgumentNullException.ThrowIfNull(deviceKeys);
 
+        // Before any await that could yield, because on Windows this reaches a consent dialog and a dialog
+        // needs the thread it was called from to be one that pumps messages. See WindowsDeviceKeyStore.
         await deviceKeys.ForgetAsync(cancellationToken).ConfigureAwait(false);
 
-        await Unlock.DetachDeviceAsync(cancellationToken)
-            .ConfigureAwait(false);
+        var stored = await Unlock.ReadAsync(cancellationToken).ConfigureAwait(false);
+
+        await Unlock.DetachDeviceAsync(cancellationToken).ConfigureAwait(false);
+
+        if (stored?.DeviceId is not { } deviceId)
+        {
+            return DeviceRevocation.NothingRegistered;
+        }
+
+        if (api is null)
+        {
+            return DeviceRevocation.LocalOnly;
+        }
+
+        // A device the account does not have is the state this was aiming at, so a false answer is an
+        // arrival rather than a failure — another machine may have revoked it first.
+        await api.RevokeDeviceAsync(deviceId, cancellationToken).ConfigureAwait(false);
+
+        return DeviceRevocation.Complete;
     }
 
     /// <summary>