Bug Fixes
2- Logging out did not end the session. The panels logout page never called the API, so the server-side session stayed active, the refresh cookie survived and the access token remained in browser storage - reloading the panel put the user straight back on the dashboard. Logging out now revokes the session, clears the refresh cookie and wipes local session data.
- Logout now also works when the access token has already expired: the session is identified from the (signature-verified) bearer token or the refresh cookie, the request is idempotent and the refresh cookie is always cleared. Previously an expired token made POST /auth/logout return 401 and left the session and its 7-day refresh cookie fully usable.