Add tests for OIDC revocation (RFC 7009), logout/end_session, userinfo endpoint, and passkey service (WebAuthn registration, authentication, credential management). Raises overall coverage from ~50% to ~56% statements.