add token revoke and panic lockdown endpoints with security logging

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/servers/api/auth/panic-handler.ts

@@ -0,0 +1,12 @@
+import type { Handler } from 'hono';
+import { triggerLockdown } from './panic';
+import { clientIp } from './client-ip';
+
+// Trigger the panic lockdown. Authenticated (Bearer token) — no password in the body. Once tripped,
+// all logins and existing sessions are refused until the server is manually restarted.
+export const panicHandler: Handler = async (ctx) => {
+  const user = ctx.get('user') as { email?: string } | undefined;
+  const origin = ctx.get('origin') as string | undefined;
+  triggerLockdown(`/panic (user=${user?.email || '?'}, origin=${origin || '-'}, ip=${clientIp(ctx)})`);
+  return ctx.json({ ok: true });
+};