auth: distress-password lockdown + explicit token-revoke endpoint

Add a duress password (DISTRESS_PASSWORD env): entering it at login trips an
in-memory full lockdown — all new logins (password + passkey) and every existing
session are refused until the server is restarted, and the login itself returns a
normal "invalid credentials" so it gives nothing away. Also add
POST /api/auth/blacklist-token as a clearly-named alias for revoking the current
JWT (same effect as signout).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/servers/api/auth/signin.ts

@@ -6,11 +6,22 @@ import { sign } from '@@/jwt';
 import { getClaudeDir } from '@@/data-path';
 import argon2 from 'argon2';
 import * as errors from '@@/custom-errors';
+import { isLockdown, triggerLockdown } from './distress';
 
 const TEST_USERS: number[] = [];
+const { DISTRESS_PASSWORD } = process.env;
 
 export const signinHandler: Handler = async function (ctx) {
   const { email, password } = ctx.get('body');
+
+  // Duress: if lockdown is active, refuse everyone (looks like a normal failed login). If the distress
+  // password was entered, trip the lockdown now and then fail the same way, giving nothing away.
+  if (isLockdown()) throw errors.UNAUTHORIZED();
+  if (DISTRESS_PASSWORD && typeof password === 'string' && password === DISTRESS_PASSWORD) {
+    triggerLockdown();
+    throw errors.UNAUTHORIZED();
+  }
+
   const origin = ctx.get('origin');
   const dbUser = await getUserByEmail(email);
   if (!dbUser) throw errors.UNAUTHORIZED();