Add legacy-auth-bridge logout endpoint

[gamadev1]

Summary

• Adds GET api/v1/legacy-auth/logout, closing a gap left by the original legacy-auth-bridge work: there was no way to end a gama-api-issued session early (tokens/revoke only covers this backend's own opaque-token store).
• Pure passthrough, same shape as register/recovery: relays the caller's raw legacy JWT (read from the Authorization header) to gama-api's own GET /users/logout (bearer-auth, confirmed against gama-api's openapi.yaml). This backend never stored the token, so gama-api is the one actually invalidating the session server-side.
• New Core:Logout config entry (appsettings.json/appsettings.Development.json), ICoreProvider.LegacyLogoutAsync/CoreProvider implementation, IIdentityService.LegacyLogoutAsync/IdentityService implementation, and the controller action.
• Docs updated: docs/api/authentication.md, docs/api/endpoints.md, docs/business/identity-and-access.md, PROJECT_SNAPSHOT.md — the "can't revoke a legacy-bridge session early" trade-off called out in the original bridge work is now qualified: tokens/revoke still can't, but this new endpoint can.

Test plan

• dotnet build — clean, 0 warnings/errors.
• Manual: log in via legacy-auth/login, then call legacy-auth/logout with the returned token as Authorization: Bearer {token} and confirm gama-api's session actually ends (e.g. a subsequent authenticated gama-api call with the same token is rejected).
• Manual: call legacy-auth/logout with no Authorization header and confirm a clean "missing token" error, not an exception.

🤖 Generated with Claude Code

[farsica]

endpoint address must changed and its logic need review

[gamadev1]

@farsica thanks for flagging this — wanted to explain the reasoning before we change anything, and get more specifics from you.

Why it's built this way today: LegacyAuthBridgeController (api/v1/legacy-auth) proxies gama-api's login/register/recovery/googleAuth/logout so users who only ever had an old-backend account can keep authenticating without a "migrate your account" step, while the frontend migrates off gama-api one flow at a time. It was kept as its own controller/route rather than folded into IdentitiesController (api/v1/identities) because it's meant to be temporary and fully removable — controller, the Legacy* methods on ICoreProvider/IIdentityService, and VerifyLegacyTokenAsync — once the frontend fully migrates off gama-api, without touching native identity code. GET logout (this PR) proxies gama-api's own GET /users/logout; we also just added a local blocklist on top (#507) so a token gama-api has logged out stops being accepted by this backend too, since ValidateLegacyJwtAsync only checks signature/issuer/audience/expiry and had no way to know a session was ended server-side.

Question: what specifically do you think needs review — should legacy-auth live under the identities route/scope instead of its own controller, or is it more about the internal logic (e.g. where Legacy* methods sit inside IdentityService)? Want to make sure we fix the right thing.