fix(auth): preserve analytics by revoking sessions on logout

[joelev]

Summary

Replace hard-delete logout behavior with explicit viewer-session revocation to preserve analytics and avoid FK-related logout failures.

Beads

• bd-1ss

Problem

POST /api/logout deleted the current sessions row. That can:

1. cascade-delete events analytics rows, and
2. fail when related tables reference sessions without cascading delete semantics.

Root Cause

Logout invalidation was implemented as physical row deletion instead of logical revocation.

Changes

• api/logout.js
  • Replaced DELETE FROM sessions with UPDATE sessions SET revoked_at = NOW() for viewer sessions.
  • Kept admin-session revocation and cookie clearing behavior unchanged.
• api/_lib/auth.js
  • getSession now requires revoked_at IS NULL.
  • last_seen updates are guarded with revoked_at IS NULL.
• migrations/013_session_revocation.sql
  • Adds sessions.revoked_at TIMESTAMPTZ (idempotent).
  • Adds index idx_sessions_revoked_at.

Validation

• Deterministic smoke harness passed:
  • logout uses session revoke UPDATE and no longer executes DELETE FROM sessions
  • revoked sessions fail authentication in getSession
• npm run build passes:
  • Built content/page.html (63624 bytes, 9 slides)

Risk

• Low to medium: introduces dependency on migration 013 before code path uses revoked_at in production.
• Expected behavior: logout immediately invalidates site-auth session while retaining historical analytics.

Rollback

• Revert commit 260344d.
• If rollback is needed after migration runs, revoked_at column/index can remain safely unused.

[joelev]

Reviewer checklist:\n\n1. Confirm logout now revokes viewer session () instead of deleting rows.\n2. Confirm denies revoked sessions and does not update for revoked rows.\n3. Confirm migration 013 is additive/idempotent ( + index).\n4. Confirm admin-session revocation and cookie-clearing behavior remain unchanged.

[joelev]

Reviewer checklist:

1. Confirm logout now revokes viewer session (revoked_at) instead of deleting sessions rows.
2. Confirm getSession denies revoked sessions and does not update last_seen for revoked rows.
3. Confirm migration 013_session_revocation.sql is additive/idempotent (revoked_at + index).
4. Confirm admin-session revocation and cookie-clearing behavior remain unchanged.