Fix (oauth2): enforce owner-scoped PAT deletion

[KevinRoebert]

Summary

This PR fixes an authorization gap in PAT deletion by enforcing token ownership at deletion time.

Changes

• Updated removeToken to require both tokenId and userId.
• Scoped delete query to:
  • _id = tokenId
  • user_id = userId
  • type = personal_access_token
• Added invalid tokenId handling with ObjectId.isValid(...) to avoid deletion attempts on malformed IDs.
• Updated delete controller flow to:
  • pass user._id into removeToken(...)
  • return 404 Token not found when no owned token is deleted (deletedCount !== 1)

Security Impact

• Prevents users from deleting PATs they do not own via token ID alone.

[Musicminion]

Thanks for your contribution ！

[Musicminion]

We will merge this in #33