Revoke licenses by product key instead of shared sub.

Add revokedKeys storage and accept key in admin revoke API so DND/TTRPG keys with the same sub can be revoked independently.

Co-authored-by: Cursor <cursoragent@cursor.com>

test/adminApi.test.mjs

@@ -113,6 +113,54 @@ void test('POST /v1/admin/product-keys creates a new product key', async () => {
   }
 });
 
+void test('POST /v1/admin/revoke by key revokes only that product key', async () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'lic-'));
+  const dataPath = path.join(tmp, 'data.json');
+  fs.writeFileSync(
+    dataPath,
+    JSON.stringify({
+      productKeys: [
+        {
+          key: 'DND-SHARED-SUB',
+          sub: 'lic_shared',
+          pid: 'dnd_player',
+          maxDevices: 2,
+          expiresAtSec: 1893456000,
+        },
+        {
+          key: 'TTRPG-SHARED-SUB',
+          sub: 'lic_shared',
+          pid: 'dnd_player',
+          maxDevices: 2,
+          expiresAtSec: 1893456000,
+        },
+      ],
+      revokedSubs: [],
+      revokedKeys: [],
+      activations: {},
+    }),
+  );
+
+  const { server, adminToken } = await makeServer(dataPath);
+  const port = await listen(server);
+  try {
+    const revoke = await request(port, 'POST', '/v1/admin/revoke', {
+      token: adminToken,
+      body: { key: 'DND-SHARED-SUB' },
+    });
+    assert.equal(revoke.status, 200);
+
+    const list = await request(port, 'GET', '/v1/admin/licenses', { token: adminToken });
+    assert.equal(list.status, 200);
+    const byKey = Object.fromEntries(list.body.licenses.map((x) => [x.key, x.revoked]));
+    assert.equal(byKey['DND-SHARED-SUB'], true);
+    assert.equal(byKey['TTRPG-SHARED-SUB'], false);
+  } finally {
+    server.close();
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+});
+
 void test('admin endpoints reject missing token', async () => {
   const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'lic-'));
   const dataPath = path.join(tmp, 'data.json');