Optional listFamilies/getFamily/revokeFamily on OidcRefreshTokenStore, implemented
for the in-memory and Postgres/Neon stores with a family index migration. The
refresh family id is passed to getAccessTokenClaims so resource servers can stamp
it into access tokens and reject tokens from a revoked device immediately.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>