synckit: invalidate sync tokens on device removal + security audit log (ultra-fuzz --deep Security A+)