feat(api): POST /api/auth/logout

Deletes the session row keyed by the cookie/bearer token and
clears the cookie on the client. Best-effort DB delete — logout
still succeeds for the client if the row's already gone.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

internal/api/api.go

@@ -35,11 +35,7 @@ type handlers struct {
 }
 
 // Stub handlers so Mount() compiles. Real implementations in later tasks
-// replace these in place (Task 7 logout, Task 8 me).
-
-func (h *handlers) handleLogout(w http.ResponseWriter, r *http.Request) {
-	writeErr(w, http.StatusNotImplemented, "not_implemented", "logout not wired")
-}
+// replace these in place (Task 8 me).
 
 func (h *handlers) handleGetMe(w http.ResponseWriter, r *http.Request) {
 	writeErr(w, http.StatusNotImplemented, "not_implemented", "me not wired")