fix auth: validate logout body, harden WebAuthn, optimize list_users

- Raise ValueError on missing request body in auth_logout
- Add username check in verify_authentication to prevent credential reuse
- Replace N+1 queries in list_users with single JOIN query

lib/auth_users.py

@@ -19,9 +19,9 @@ from lib.db import (
     Q_DELETE_PERMISSIONS,
     Q_DELETE_USER,
     Q_INSERT_USER,
-    Q_SELECT_ALL_USERS,
     Q_SELECT_PERMISSIONS,
     Q_SELECT_USER_BY_NAME,
+    Q_SELECT_USERS_WITH_PERMS,
     Q_UPDATE_PASSWORD,
     Q_UPSERT_PERMISSION,
     get_db,
@@ -244,21 +244,22 @@ def list_users() -> list[dict[str, Any]]:
         List of user summary dicts.
     """
     db = get_db()
-    rows = db.query(Q_SELECT_ALL_USERS, ())
+    rows = db.query(Q_SELECT_USERS_WITH_PERMS, ())
 
-    result = []
+    users: dict[int, dict[str, Any]] = {}
     for row in rows:
-        username = row["username"]
-        permissions = _get_permissions(username)
-        result.append(
-            {
-                "id": row["id"],
-                "username": username,
-                "permissions": permissions,
+        uid = row["id"]
+        if uid not in users:
+            users[uid] = {
+                "id": uid,
+                "username": row["username"],
+                "permissions": {},
                 "created_at": row["created_at"],
             }
-        )
-    return result
+        if row["subsystem"] is not None:
+            users[uid]["permissions"][row["subsystem"]] = row["level"]
+
+    return list(users.values())
 
 
 def delete_user(username: str) -> bool: