Build key-bound refresh tokens with clear security rules.
Recent revisions are kept. Restoring one creates a new revision.
