fix auth: validate logout body, harden WebAuthn, optimize list_users

- Raise ValueError on missing request body in auth_logout
- Add username check in verify_authentication to prevent credential reuse
- Replace N+1 queries in list_users with single JOIN query

daemon/handlers/auth.py

@@ -135,7 +135,7 @@ def auth_logout(request: Any, body: Any) -> dict[str, Any]:
         Success response.
     """
     if not body:
-        return {}
+        raise ValueError("Request body is required")
 
     jti = body.get("jti")
     if jti: