fix(auth): invalidate session server-side on logout, not just the cookie

/auth/logout previously only cleared the client's cookie, leaving the
session token valid in the sessions table — a stolen cookie captured
before logout would still work afterwards. Add BackendDbInterface#deleteSession
(implemented in SqliteInterface) and call it from the logout route using
the session token from the cookie. Caught by the new auth-http.test.ts
integration test, updated to assert the session is actually invalidated.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/webapi/apirouter.ts

@@ -28,6 +28,8 @@ export function apirouter(db: BackendDbInterface): KoaRouter {
   });
   router.post("/auth/logout", authenticate(db), async (ctx) => {
     if (ctx.session!.source !== "session") throw new InvalidAbodeError();
+    const token = ctx.cookies.get("abode_session");
+    if (token) await db.deleteSession(token as `as_${string}`);
     ctx.cookies.set("abode_session", "", { expires: new Date("1970-01-01") });
     ctx.status = 204;
   });