resetadmin cannot revoke API tokens, and says access has ended

[rainmanjam]

From the poka-yoke audit of 2026-09-04. Lens: fixed-value. Today: rung 0. Device reaches: rung 2 (Warning).

The mistake available

Be locked out — which is the compromise case — reset the password from the CLI,
and believe access is ended.

cmd/polyemesis/resetadmin.go:41-58 bumps users.token_epoch and prints
"every existing session has been signed out". API tokens are untouched, and
nothing lists them.

The HTTP handler for the same gesture (handleChangePassword) takes a
RevokeAPITokens flag, revokes on request, and reads back and discloses the
surviving tokens so the operator can see what still has access. The CLI does
neither.

What happens

The path an operator reaches for precisely when they cannot sign in is the one
that cannot revoke the credential most likely to have been taken — and it
reports success in words that imply otherwise.

Today

Rung 0.

Device → rung 2, Warning

--revoke-api-tokens, plus always printing the surviving-token inventory,
mirroring the disclosure the HTTP handler already performs.

Why not Control (always revoke): it would be wrong for the routine-rotation
case, which is the common one — the HTTP handler's own comment makes this
argument and it holds here too. The device is that the operator is told what
survives, every time, rather than being left to assume.

Related: #706 — a revocation through this path would also need to reach live
WebSockets, which the in-process revoked set cannot do from a separate CLI
process. Fixing #706 by having the socket ask the store makes this work for free.

[rainmanjam]

Device built — PR #722. Rung 2, Warning.

resetadmin now always lists the surviving tokens and how to end them,
mirroring the disclosure the HTTP handler already performs, and
--revoke-api-tokens does the ending.

Opt-in rather than implied, for the reason that handler argues: routine rotation
is the common case and destroying every integration's credential is the wrong
default for it.

Its two failure arms matter most — they fire exactly when the command cannot
answer the question, and an operator not told that silence means unknown reads
it as nothing. Both are tested, reached by breaking the token table in two ways
that survive db.Open: a BEFORE DELETE trigger that aborts, and a row whose
created_at holds text so the scan fails. Dropping the table does not work —
resetadmin opens the database itself and Open runs the schema, which puts it
straight back.

Also closed by #706's change: DeleteAllAPITokens from here now ends the
sockets, because the check asks the store rather than an in-process map.