Classifies a token lookup failure: Ok(()) for “no such live token”, so the caller can try the
other token type, and 5xx for a storage failure (RFC 7009 permits 5xx on genuine backend
failures, but not on an unknown token).
Deletes the presented access token if it belongs to the authenticated client, and evicts its
cached user mapping so it cannot keep authenticating from a stale cache hit.
Revokes the presented refresh token if it belongs to the authenticated client, together with
everything else issued from the same (user, client) grant.