vault: session-gated notifications WS + lifecycle cleanup

- token-store: shared "give me a valid Vaultwarden access token" (proactive
  refresh) used by both the HTTP proxy and the WS; router refactored onto it.
- notifications WS: validates the platform session in `open` (deferred, owner
  only), injects the stored Vaultwarden token into the upstream, and buffers
  client frames during the async setup so the SignalR handshake isn't dropped.
  The device connects with its platform JWT (?access_token=), never a vault one.
- lifecycle: logout drops the vault token set (keeps the protector); distress
  (/auth/revoke) and panic wipe both token set and protector, forcing a
  one-time master-password re-setup.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/servers/api/auth/revoke-handler.ts

@@ -1,10 +1,10 @@
 import type { Handler } from 'hono';
-import { blacklistToken, cleanupExpiredTokens } from 'officerdb';
+import { blacklistToken, cleanupExpiredTokens, clearVaultTokens, clearVaultUnlockKey } from 'officerdb';
 import { clientIp } from './client-ip';
 
 // Distress: blacklist the current token (same as signout) but log it as a security event.
 export const revokeHandler: Handler = async (ctx) => {
-  const user = ctx.get('user') as { jti: string; exp: number; email?: string };
+  const user = ctx.get('user') as { id: number; jti: string; exp: number; email?: string };
   const origin = ctx.get('origin') as string | undefined;
 
   console.warn(
@@ -12,6 +12,12 @@ export const revokeHandler: Handler = async (ctx) => {
   );
 
   await blacklistToken(user.jti, user.exp);
+
+  // Distress wipes the vault session AND the stored protector key — forces a one-time master-password
+  // re-setup, the correct "someone got in" behavior.
+  clearVaultTokens(user.id).catch(() => {});
+  clearVaultUnlockKey(user.id).catch(() => {});
+
   cleanupExpiredTokens().catch(() => {});
 
   return ctx.json({ ok: true });