Logout

Logout (invalidates the token on the client side)

Note: JWTs are stateless, so this endpoint is mainly for logging and to allow the client to "forget" the token. For true server-side invalidation, a token blacklist would be needed.

Args: credentials: Bearer token from Authorization header

Returns: Logout confirmation