feat: detect revoked GitHub token and prompt re-authentication

- Add TokenRevoked to AUTH_ERROR_MESSAGES in signin page showing
  'Your GitHub access was revoked. Please sign in again to continue.'
- Add TokenRevokedGuard client component that watches session.error
  and calls signOut() redirecting to /auth/signin?error=TokenRevoked
- Mount TokenRevokedGuard in dashboard page
- Install rehype-sanitize (missing dep, unrelated to this feature)

The jwt callback in auth.ts already sets token.error = 'TokenRevoked'
when GET /user returns 401. This PR completes the user-facing side.

Closes #884

Author: Subhra-Nandi