fix: add logout endpoint and session cleanup

internal/httpapi/router.go

@@ -52,6 +52,7 @@ func NewRouter(cfg config.Config, database *sql.DB, scanService *scanner.Service
 
 	r.Route("/api", func(api chi.Router) {
 		api.Post("/auth/login", application.login)
+		api.Post("/auth/logout", application.logout)
 
 		api.Group(func(private chi.Router) {
 			private.Use(application.requireAuth)
@@ -142,6 +143,25 @@ func (a app) login(w http.ResponseWriter, r *http.Request) {
 	writeJSON(w, http.StatusOK, session)
 }
 
+func (a app) logout(w http.ResponseWriter, r *http.Request) {
+	token := strings.TrimSpace(strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer "))
+	if token == "" {
+		var payload struct {
+			Token string `json:"token"`
+		}
+		if err := json.NewDecoder(r.Body).Decode(&payload); err == nil {
+			token = strings.TrimSpace(payload.Token)
+		}
+	}
+
+	if err := a.auth.Logout(r.Context(), token); err != nil {
+		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": "logout failed"})
+		return
+	}
+
+	writeJSON(w, http.StatusOK, map[string]any{"status": "ok"})
+}
+
 func (a app) me(w http.ResponseWriter, r *http.Request) {
 	user := currentUserFromContext(r)
 	writeJSON(w, http.StatusOK, user)