feat(auth): add access key listing and revocation

docs/auth/authentication/using-authentication.mdx

@@ -109,7 +109,7 @@ the SDK's OIDC refresh flow:
 
 ```bash
 # Create a Scoped Access Key with the platform default expiry and print the token once.
-nemo auth access-keys create --name ci-build
+nemo auth access-keys create --name ci-build --description "CI build automation"
 ```
 
 Scoped Access Key management commands live under the `auth` namespace as
@@ -129,7 +129,19 @@ groups present when the key is created. By default, new keys use the platform's
 configured default expiry, which is 30 days unless the administrator changes it.
 Pass `--expires-in <seconds>` to request a specific finite lifetime. Pass
 `--expires-in none` only for deployments where the administrator has explicitly
-allowed unlimited keys. Revocation and rotation are not implemented.
+allowed unlimited keys.
+
+List keys or revoke one by its stable `jti`:
+
+```bash
+nemo auth access-keys list
+nemo auth access-keys list --page 2 --page-size 100
+nemo auth access-keys revoke ak_0123456789abcdef0123456789abcdef
+```
+
+The list includes each key's `ACTIVE`, `EXPIRED`, or `REVOKED` status plus its
+description, issuer, audiences, creation time, and expiration time. Revocation takes
+effect on subsequent authenticated platform requests. Rotation is not implemented.
 
 ### Token Inspection
 

docs/auth/deployment/configuration.mdx

@@ -89,8 +89,8 @@ Nested auth keys use a double underscore after `NMP_AUTH_`: for example,
 
 Scoped Access Keys let an authenticated user create a scoped bearer token for
 non-SDK clients and automation. The implementation creates user-scoped signed
-JWT access keys and rejects service principals. Revocation and rotation are not
-implemented.
+JWT access keys, persists their lifecycle metadata, and rejects service principals.
+Users can list and revoke their own keys. Rotation is not implemented.
 
 Scoped Access Keys are an auth-service feature exposed under the auth CLI
 namespace (`nemo auth access-keys ...`) and the `/apis/auth/v2/access-keys` API routes.

docs/cli/reference.mdx

@@ -276,11 +276,13 @@ nemo auth access-keys [OPTIONS] COMMAND [ARGS]...
 
 **Commands:**
 
-* `create`: Create a Scoped Access Key for the current authenticated...
+* `create`: Create a Scoped Access Key for the currently...
+* `list`: List Scoped Access Keys owned by the currently...
+* `revoke`: Revoke a Scoped Access Key owned by the currently...
 
 ##### nemo auth access-keys create
 
-Create a Scoped Access Key for the current authenticated user.
+Create a Scoped Access Key for the currently authenticated user.
 
 **Usage:**
 
@@ -291,12 +293,50 @@ nemo auth access-keys create [OPTIONS]
 **Options:**
 
 * `--name, -n`: Optional human-readable label for the Scoped Access Key.
+* `--description, -d`: Optional description for the Scoped Access Key.
 * `--expires-in`: Scoped Access Key lifetime in seconds. Use 'none' to request no expiration.
 
 **Help:**
 
 * `--help, -h`: Show this message and exit.
 
+##### nemo auth access-keys list
+
+List Scoped Access Keys owned by the currently authenticated user.
+
+**Usage:**
+
+```shell
+nemo auth access-keys list [OPTIONS]
+```
+
+**Options:**
+
+* `--page <INTEGER RANGE>`: Page number to retrieve. [default: 1]
+* `--page-size <INTEGER RANGE>`: Number of keys to retrieve per page. [default: 100]
+
+**Help:**
+
+* `--help, -h`: Show this message and exit.
+
+##### nemo auth access-keys revoke
+
+Revoke a Scoped Access Key owned by the currently authenticated user.
+
+**Usage:**
+
+```shell
+nemo auth access-keys revoke [OPTIONS] JTI
+```
+
+**Arguments:**
+
+* `<JTI>`: Stable ID of the Scoped Access Key to revoke.
+
+**Help:**
+
+* `--help, -h`: Show this message and exit.
+
 ### nemo services
 
 Run platform services locally.