Add access keys revoke and list

Signed-off-by: anastasia-nesterenko <anesterenko@nvidia.com>

Author: anastasia-nesterenko

docs/auth/authentication/using-authentication.mdx

@@ -109,7 +109,7 @@ the SDK's OIDC refresh flow:
 
 ```bash
 # Create a Scoped Access Key with the platform default expiry and print the token once.
-nemo auth access-keys create --name ci-build
+nemo auth access-keys create --name ci-build --description "CI build automation"
 ```
 
 Scoped Access Key management commands live under the `auth` namespace as
@@ -129,7 +129,18 @@ groups present when the key is created. By default, new keys use the platform's
 configured default expiry, which is 30 days unless the administrator changes it.
 Pass `--expires-in <seconds>` to request a specific finite lifetime. Pass
 `--expires-in none` only for deployments where the administrator has explicitly
-allowed unlimited keys. Revocation and rotation are not implemented.
+allowed unlimited keys.
+
+List keys or revoke one by its stable `jti`:
+
+```bash
+nemo auth access-keys list
+nemo auth access-keys revoke ak_example
+```
+
+The list includes each key's `ACTIVE`, `EXPIRED`, or `REVOKED` status plus its
+description, issuer, audiences, creation time, and expiration time. Revocation takes
+effect on subsequent authenticated platform requests. Rotation is not implemented.
 
 ### Token Inspection
 

docs/auth/deployment/configuration.mdx

@@ -89,8 +89,8 @@ Nested auth keys use a double underscore after `NMP_AUTH_`: for example,
 
 Scoped Access Keys let an authenticated user create a scoped bearer token for
 non-SDK clients and automation. The implementation creates user-scoped signed
-JWT access keys and rejects service principals. Revocation and rotation are not
-implemented.
+JWT access keys, persists their lifecycle metadata, and rejects service principals.
+Users can list and revoke their own keys. Rotation is not implemented.
 
 Scoped Access Keys are an auth-service feature exposed under the auth CLI
 namespace (`nemo auth access-keys ...`) and the `/apis/auth/v2/access-keys` API routes.

docs/cli/reference.mdx

@@ -270,6 +270,8 @@ nemo auth access-keys [OPTIONS] COMMAND [ARGS]...
 **Commands:**
 
 * `create`: Create a Scoped Access Key for the current authenticated...
+* `list`: List Scoped Access Keys owned by the current...
+* `revoke`: Revoke a Scoped Access Key owned by the current...
 
 ##### nemo auth access-keys create
 
@@ -284,12 +286,45 @@ nemo auth access-keys create [OPTIONS]
 **Options:**
 
 * `--name, -n`: Optional human-readable label for the Scoped Access Key.
+* `--description, -d`: Optional description for the Scoped Access Key.
 * `--expires-in`: Scoped Access Key lifetime in seconds. Use 'none' to request no expiration.
 
 **Help:**
 
 * `--help, -h`: Show this message and exit.
 
+##### nemo auth access-keys list
+
+List Scoped Access Keys owned by the current authenticated user.
+
+**Usage:**
+
+```shell
+nemo auth access-keys list [OPTIONS]
+```
+
+**Help:**
+
+* `--help, -h`: Show this message and exit.
+
+##### nemo auth access-keys revoke
+
+Revoke a Scoped Access Key owned by the current authenticated user.
+
+**Usage:**
+
+```shell
+nemo auth access-keys revoke [OPTIONS] JTI
+```
+
+**Arguments:**
+
+* `<JTI>`: Stable ID of the Scoped Access Key to revoke.
+
+**Help:**
+
+* `--help, -h`: Show this message and exit.
+
 ### nemo services
 
 Run platform services locally.