Log out on every device

Revokes EVERY refresh-token family for the authenticated user plus the caller's current access token, then clears this browser's cookies. Requires a live session (unlike /auth/logout, which is deliberately forgiving because its only job is to clear cookies).

T712: /auth/logout used to do this implicitly — logging out on one device signed the user out everywhere. It now ends only the calling device's session, and this endpoint is the explicit "everywhere" action.