auth: distress-password lockdown + explicit token-revoke endpoint

Add a duress password (DISTRESS_PASSWORD env): entering it at login trips an
in-memory full lockdown — all new logins (password + passkey) and every existing
session are refused until the server is restarted, and the login itself returns a
normal "invalid credentials" so it gives nothing away. Also add
POST /api/auth/blacklist-token as a clearly-named alias for revoking the current
JWT (same effect as signout).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/servers/_middlewares/user-middleware.ts

@@ -2,6 +2,7 @@ import type { MiddlewareHandler } from 'hono';
 import { verify } from '@@/jwt';
 import * as errors from '@@/custom-errors';
 import { isOriginAllowed } from './origin-validation';
+import { isLockdown } from '../api/auth/distress';
 import { getUserById, isTokenBlacklisted } from 'officerdb';
 
 // Role permissions: which HTTP methods each role can use
@@ -21,6 +22,9 @@ function isMethodAllowed(role: string | null, method: string): boolean {
 }
 
 export const userMiddleware: MiddlewareHandler = async function (ctx, next) {
+  // Duress lockdown: reject every authenticated request, cutting off all existing sessions.
+  if (isLockdown()) throw errors.UNAUTHORIZED();
+
   const { authorization } = ctx.req.header();
 
   // Support token in query param for media elements (<audio>, <video>, <img>)