Add logout button to docs page - #25

Note

Medium Risk
Touches session revocation and cookie handling, but uses existing origin CSRF checks and is covered by focused route and UI tests.

Overview
Signed-in users on /docs get a log out control next to the account line (POST form to /logout), with light flex styling on the session header row.

POST /logout enforces originOk CSRF checks, revokes the active sessions row when a valid jh_sess token is present, always clears the session cookie via new clearSessionCookieHeader(), and redirects to /login. Vitest covers the route (revoke, stale cookie, cross-site 403) and the docs HTML includes the logout form.

^{Reviewed by Cursor Bugbot for commit 5438dfd. Bugbot is set up for automated code reviews on this repo. Configure here.}