fix(auth): invalidate session server-side on logout, not just the cookie

/auth/logout previously only cleared the client's cookie, leaving the
session token valid in the sessions table — a stolen cookie captured
before logout would still work afterwards. Add BackendDbInterface#deleteSession
(implemented in SqliteInterface) and call it from the logout route using
the session token from the cookie. Caught by the new auth-http.test.ts
integration test, updated to assert the session is actually invalidated.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

test/tools/authenticate.test.ts

@@ -71,6 +71,7 @@ function makeMockDb(
     getUserByLogin: async () => { throw new NotFoundAbodeError(); },
     getUserBySession: async () => { throw new NotFoundAbodeError(); },
     createSession: async () => `as_${"0".repeat(32)}`,
+    deleteSession: async () => {},
     getUserByApikey: async () => { throw new NotFoundAbodeError(); },
     ...overrides,
   };