identity: opaque grant-backed tokens — issue/introspect/revoke (9 tests)

Token table is a process; the token is an opaque make_ref carrying no
information. introspect() is a live table lookup every time, so
revocation is real (RFC 7009 §2): a revoked token reads {inactive} on
the next introspection with no validity window. Reply shapes follow
RFC 7662 §2.2 ({active, Subject, Client, Scope} / {inactive}).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/identity/conformance.sh

@@ -29,6 +29,7 @@ trap "rm -f $TMPFILE $OUTFILE" EXIT
 # Each suite: name | counter pass | counter total
 SUITES=(
   "session|id-session-test-pass|id-session-test-count"
+  "token|id-token-test-pass|id-token-test-count"
 )
 
 cat > "$TMPFILE" << 'EPOCHS'
@@ -41,9 +42,13 @@ cat > "$TMPFILE" << 'EPOCHS'
 (load "lib/erlang/transpile.sx")
 (load "lib/erlang/runtime.sx")
 (load "lib/identity/session.sx")
+(load "lib/identity/token.sx")
 (load "lib/identity/tests/session.sx")
+(load "lib/identity/tests/token.sx")
 (epoch 100)
 (eval "(list id-session-test-pass id-session-test-count)")
+(epoch 101)
+(eval "(list id-token-test-pass id-token-test-count)")
 EPOCHS
 
 timeout 600 "$SX_SERVER" < "$TMPFILE" > "$OUTFILE" 2>&1