M15: synchronize contracts and acceptance

backend/app/api/routers/auth.py

@@ -19,6 +19,7 @@ from app.core.security import (
 from app.models.user import User
 from app.schemas import CurrentUser, PasswordLoginRequest
 from app.services.audit import record_audit_event
+from app.services.sessions import revoke_session
 
 router = APIRouter(prefix="/api/v1/auth", tags=["auth"])
 settings = get_settings()
@@ -37,6 +38,7 @@ def _set_session(response: Response, user: User) -> None:
         SessionPayload(
             user_id=str(user.id), public_ref=user.public_ref, role=user.role,
             display_name=user.display_name, issued_at=int(time.time()),
+            session_id=str(uuid.uuid4()),
         )
     )
     response.set_cookie(
@@ -114,7 +116,8 @@ def get_session(response: Response, user: CurrentUser = Depends(get_current_user
 def logout(request: Request, response: Response, db: Session = Depends(get_db)) -> dict:
     token = request.cookies.get(settings.session_cookie_name)
     payload = read_session_token(token) if token else None
-    if payload is not None:
+    if payload is not None and token is not None:
+        revoke_session(db, token, payload)
         record_audit_event(
             db,
             actor_type="user",