feat: add JWT blacklist for logout with TTL cleanup

blacklistJwt() adds token to in-memory blacklist until its natural expiry.
verifyJwt() checks blacklist before signature verification.
Cleanup interval removes expired entries every 10 minutes.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/src/middleware/jwt.test.ts

@@ -1,5 +1,5 @@
 import { describe, it, expect, vi, afterEach } from 'vitest'
-import { createJwt, verifyJwt } from './jwt.js'
+import { createJwt, verifyJwt, blacklistJwt } from './jwt.js'
 
 describe('JWT', () => {
   afterEach(() => {
@@ -66,4 +66,17 @@ describe('JWT', () => {
     expect(verifyJwt('a.b')).toBeNull()
     expect(verifyJwt('a.b.c.d')).toBeNull()
   })
+
+  it('rejects blacklisted JWT (logout)', () => {
+    const token = createJwt('pubkey-logout', 'bot-logout')
+
+    // Token works before blacklisting
+    expect(verifyJwt(token)).not.toBeNull()
+
+    // Blacklist the token
+    blacklistJwt(token)
+
+    // Token is now rejected
+    expect(verifyJwt(token)).toBeNull()
+  })
 })