per-user api keys, resolved at both identity doors

a user can mint a long-lived key for an app or a device instead of
carrying a 30-day session, so multiple logins on the mobile apps are
per-device revocable rather than one shared token.

identity was being decided independently in userMiddleware and
originScopeMiddleware, each verifying the token itself. teaching only
one of them a new credential format is how those two stop agreeing, so
both now call resolveAuthToken and neither knows what a bearer string
is. verified: a member's key returns the same status as their jwt on
every route tried, 403s included.

a key carries its holder's full authority — not an escalation, it
equals what the password could already do. scoping wants a scopes
column, not a change here.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/servers/api/auth/signout.ts

@@ -1,10 +1,13 @@
 import type { Handler } from 'hono';
+import type { AuthIdentity } from '@@/auth-token';
 import { blacklistToken, cleanupExpiredTokens, clearVaultTokens } from 'officerdb';
 
 export const signoutHandler: Handler = async (ctx) => {
-  const user = ctx.get('user') as { id: number; jti: string; exp: number };
+  const user = ctx.get('user') as AuthIdentity;
 
-  await blacklistToken(user.jti, user.exp);
+  // Only a session has something to blacklist. An API key cannot be signed out — it is revoked by id in
+  // the keys API, which is the point of holding one instead of a session.
+  if (user.jti && user.exp) await blacklistToken(user.jti, user.exp);
 
   // Drop the brokered vault session on logout (the protector key stays, so re-login is frictionless).
   clearVaultTokens(user.id).catch(() => {});