chore(cli): campus.audit polish — message punctuation, --json on revoke, dry-run kwargs, README wording #59

Context

Small polish items found while reviewing the campus audit command group
(#55). None of them change behaviour in a risky way; they are the
difference between a group that reads like the rest of the CLI and one that
does not.

Items

1. Double full stop in API failure messages. fail_api builds
   f"Failed to {action}: {message}.", so a server message that already
   ends in a sentence period comes out as …apikeys:read.. Re-run ….
2. campus audit keys revoke has no --json. Every other command in
   the group does; scripts that sweep keys have to parse the human
   output.
3. campus audit keys list --dry-run always emits every argument.
   The snippet shows owner_id=None, active_only=True, limit=None even
   when the caller passed none of them, which reads oddly next to the
   group's promise of showing only what was passed. active_only only
   needs to appear when --all widened it (the server default is
   active_only=True).
4. README wording. The quick-start example led with
   campus audit login --api-key …, which puts the key in the shell
   history and in the process list; the env var and the hidden prompt are
   the safer paths and should lead. The README also described owner_id as
   an "email-format label", but the server types it as schema.UserID
   (openapi.Email), which is a plain str subclass with no format
   validation — any label is accepted, and an email is only the
   convention.

Acceptance

• A server error message ending in "." is not followed by a second ".".
• campus audit keys revoke --json prints the revocation as JSON.
• campus audit keys list --dry-run shows only the arguments the
  caller passed.
• The README leads with the env var / prompt for campus audit login,
  and describes owner_id as a free-form label.