database.delete_refresh_token is not used

We should identify where in the code we ought to be deleting refresh tokens as the currently the `delete_refresh_token` function from `database` as it is not used.

Presently we are simply relying on the TTL to expire:
```
# Remove refresh tokens that haven't been accessed over 90 days
mongo.db.refresh_tokens.create_index(
"last_accessed", expireAfterSeconds=REFRESH_TOKEN_IDEL_EXPIRATION
)
```

Start by tracing uses of database.delete_refresh_token and the refresh-token lifecycle around the database TTL index shown in the issue. Identify the relevant deletion paths and verify that explicit cleanup occurs where appropriate while the 90-day TTL remains effective.

Written by the indexing model from the issue text.