fix(api): trim whitespace from bearer token in logout

sessionTokenFromHTTP now matches extractBearerToken's trimming
behavior. Without this, a bearer header with trailing whitespace
(e.g. a buggy client or proxy) authenticates via RequireUser but
hashes the padded value on logout, silently no-oping and leaving
the server-side session alive.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

internal/api/auth.go

@@ -4,6 +4,7 @@ import (
 	"encoding/json"
 	"errors"
 	"net/http"
+	"strings"
 	"time"
 
 	"github.com/jackc/pgx/v5"
@@ -41,7 +42,10 @@ func (h *handlers) handleLogout(w http.ResponseWriter, r *http.Request) {
 
 // sessionTokenFromHTTP duplicates the internal helper in internal/auth
 // because that one is unexported. Cheap to repeat here; keeping the auth
-// package's internal helper package-private is worth more than DRY.
+// package's internal helper package-private is worth more than DRY. Must
+// match that helper's trimming behavior exactly — otherwise a bearer with
+// trailing whitespace authenticates via RequireUser (which trims) but logout
+// hashes the padded value and silently no-ops, leaving the session alive.
 func sessionTokenFromHTTP(r *http.Request) string {
 	if c, err := r.Cookie(auth.SessionCookieName); err == nil && c.Value != "" {
 		return c.Value
@@ -49,7 +53,7 @@ func sessionTokenFromHTTP(r *http.Request) string {
 	h := r.Header.Get("Authorization")
 	const prefix = "bearer "
 	if len(h) > len(prefix) && (h[:7] == "Bearer " || h[:7] == "bearer ") {
-		return h[len(prefix):]
+		return strings.TrimSpace(h[len(prefix):])
 	}
 	return ""
 }