[CT-32] Implement real POST /revoke handler in the Rust verifier

[mftee]

Overview

revoke_document() validates the hash format but then unconditionally returns 404 with "revoke endpoint not yet implemented". Like submit_document, it has no State<AppState> and cannot actually record a revocation anywhere.

File

contract/src/lib.rs (revoke_document)

Acceptance Criteria

• Add State<AppState> to revoke_document's signature
• Persist the revocation (reason, revoked_by, timestamp) keyed by document hash in the cache backend, following the same pattern record_transfer uses for transfer history (key format e.g. revoke:{hash})
• verify_document/verify_document_by_hash should reflect a revoked status once this lands (or a follow-up issue notes the dependency explicitly)
• Return RevokeResponse{ transaction_id, revoked_at } on success with a real transaction_id, not a hardcoded stub
• Add integration tests covering revoke-then-verify showing the revoked state