#40 FTX-40: Capability token hardening

HITL_TOKEN_SECRET mandatory in prod (delete futex-dev-secret fallback + master-key reuse); verify tenant binding (payload t); consult action_tokens row (revoked_at, new column) on review path; TTLs from env (REVIEW_TOKEN_TTL/ONE_CLICK_TOKEN_TTL). EV-TOK-1 test matrix: forged/expired/tenant-mismatch/revoked. Phase 1.