Logout

Logout the current user.

Three things happen:

1. Blacklist the access token's JTI so it can't be replayed in the remaining window before its natural expiry.
2. Revoke the exact refresh row bound into the signed access JWT. The path-scoped refresh cookie does not need to ride on this request and other devices remain active.
3. Clear both cookies on the response.

Returns 200 with a JSON body. The cookies are cleared via Set-Cookie: ...=; Max-Age=0 on the response (browsers will drop them; subsequent requests won't carry them).

Token source: the badge_session cookie first (post-PR-G default), falling back to Authorization: Bearer for non-cookie clients. The pre-PR-F as_session cookie was dead code and was removed.