fix: use Node storage in the revocation e2e, and drop the now-dead storage API (#2144)

The CI coverage job failed with `ReferenceError: sessionStorage is not defined`.
`revocation-e2e.test.ts` used `BrowserOAuthStorage`, but the `integration`
vitest project runs in the node environment, not happy-dom. Node 22 gates Web
Storage behind a flag while newer Node exposes it by default, so it passed
locally and failed in CI. It uses `NodeOAuthStorage` with a temp dir now,
matching the other OAuth integration tests, with a comment naming the trap.

Also from Copilot review round 21: `listIssuers` and `getIssuerTokens` became
dead production API when `takeRevocationSnapshot` took over — a grep finds them
only in their own implementations and tests. Keeping them would widen the
exported `OAuthStorage` contract and force every implementation and mock to
carry methods nothing calls. Removed, along with their tests and the mock
entries in four suites.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0177mPHAdECD18nLLCTwR5rh
Signed-off-by: cliffhall <cliff@futurescale.com>

core/auth/storage.ts

@@ -223,33 +223,6 @@ export interface OAuthStorage {
    */
   takeRevocationSnapshot(serverUrl: string): Promise<RevocationSnapshot>;
 
-  /**
-   * Tokens bound to **exactly** `issuer`, with no legacy-unkeyed fallback.
-   *
-   * {@link getTokens} deliberately falls back to the legacy unkeyed slot when
-   * the issuer slot holds none — that is what keeps a pre-SEP-2352 entry
-   * working. But a caller enumerating {@link listIssuers} must not treat that
-   * fallback as belonging to the issuer it happened to ask for: during a
-   * partially migrated flow it would label an old, unbound token with a newly
-   * discovered authorization server and send it there (#2144).
-   */
-  getIssuerTokens(
-    serverUrl: string,
-    issuer: string,
-  ): Promise<OAuthTokens | undefined>;
-
-  /**
-   * The authorization-server `issuer` keys holding credentials for this server
-   * (SEP-2352). Empty when the entry predates issuer binding — its credentials
-   * live in the legacy unkeyed slot, which the ctx-less reads above answer.
-   *
-   * Exists because {@link clear} deletes **every** issuer slot: anything that
-   * must act on the credentials before they are dropped (RFC 7009 revocation,
-   * #2144) would otherwise see only the active issuer's and silently discard
-   * the rest.
-   */
-  listIssuers(serverUrl: string): Promise<string[]>;
-
   /**
    * Clear all OAuth data for a server
    */