Revoke a signer as a whole, not permission by permission

### Description

The registry has no way to revoke a signer as a whole. Storage is `authorizationExpiry[user][signer][permission]`, and `revoke` writes zero only into the permissions the caller names. Nothing enumerates a signer's permissions on chain, so a client can only revoke the permissions it knows about, and any permission granted through another client, or added to the protocol later, stays live.

The same shape means expiries are per permission. A `login` that names a subset of permissions leaves the others on their old expiry, so shortening or renewing a key needs the full permission list too.

### Impact

A user who revokes a key in the console, or with `filecoin-pin session revoke`, cannot be sure the key is dead. Raised during review of the console's session keys page in FilOzone/filecoin-pay-explorer#346 (https://github.com/FilOzone/filecoin-pay-explorer/pull/346#discussion_r3971152844). The console's workaround is to send every permission it knows on revoke, which covers today's four FWSS permissions and nothing added later.

### Expected behavior

A caller can end a signer's authorization for every permission in one call, without knowing the list. Two shapes that fit the current storage:

1. A per-signer epoch: `authorizationExpiry` reads return zero when `signerEpoch[user][signer]` is newer than the grant. `revokeAll(signer)` bumps the epoch.
2. A stored permission set per signer that `login` appends to and `revokeAll` iterates.

Either also gives clients a way to read what a signer holds, which the console reconstructs from events today.

### Additional context

Spec discussion: FilOzone/filecoin-services#455. Contract: `src/SessionKeyRegistry.sol`, `_setAuthorizations`.

Inizia da src/SessionKeyRegistry.sol, in particolare authorizationExpiry e _setAuthorizations, poi leggi la discussione sulla specifica collegata relativa al modello di storage previsto. Definisci il completamento in termini di revoca di ogni autorizzazione per un signer senza una lista di permessi fornita dal chiamante, preservando il corretto comportamento di scadenza del login ed esponendo ciò che possiede un signer.

Scritto dal modello di indicizzazione a partire dal testo della issue.