auth: distress-password lockdown + explicit token-revoke endpoint

Add a duress password (DISTRESS_PASSWORD env): entering it at login trips an
in-memory full lockdown — all new logins (password + passkey) and every existing
session are refused until the server is restarted, and the login itself returns a
normal "invalid credentials" so it gives nothing away. Also add
POST /api/auth/blacklist-token as a clearly-named alias for revoking the current
JWT (same effect as signout).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/servers/api/auth/passkey-router.ts

@@ -4,6 +4,7 @@ import { createRouter } from '../../create-router';
 import { userMiddleware, passkeyRateLimiter } from '../../_middlewares';
 import { sign } from '../../jwt';
 import * as errors from '../../custom-errors';
+import { isLockdown } from './distress';
 import {
   getUserByEmail,
   getPasskeysByUserIdAndOrigin,
@@ -128,6 +129,7 @@ passkeyRouter.get('/signin/:email', passkeyRateLimiter, passkeyRouterGet);
 
 // Verify passkey authentication and issue token
 const passkeyRouterPostVerify: Handler = async (ctx) => {
+  if (isLockdown()) throw errors.UNAUTHORIZED(); // duress lockdown blocks passkey logins too
   const { email } = ctx.req.param();
   const origin = ctx.get('origin') as string;
   const rpId = getRpId(origin);