add token revoke and panic lockdown endpoints with security logging

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/servers/api/auth/passkey-router.ts

@@ -4,7 +4,7 @@ import { createRouter } from '../../create-router';
 import { userMiddleware, passkeyRateLimiter } from '../../_middlewares';
 import { sign } from '../../jwt';
 import * as errors from '../../custom-errors';
-import { isLockdown } from './distress';
+import { isLockdown, noteBlocked } from './panic';
 import {
   getUserByEmail,
   getPasskeysByUserIdAndOrigin,
@@ -129,7 +129,10 @@ passkeyRouter.get('/signin/:email', passkeyRateLimiter, passkeyRouterGet);
 
 // Verify passkey authentication and issue token
 const passkeyRouterPostVerify: Handler = async (ctx) => {
-  if (isLockdown()) throw errors.UNAUTHORIZED(); // duress lockdown blocks passkey logins too
+  if (isLockdown()) {
+    noteBlocked('passkey login');
+    throw errors.UNAUTHORIZED();
+  } // duress lockdown blocks passkey logins too
   const { email } = ctx.req.param();
   const origin = ctx.get('origin') as string;
   const rpId = getRpId(origin);