fix auth: validate logout body, harden WebAuthn, optimize list_users

- Raise ValueError on missing request body in auth_logout
- Add username check in verify_authentication to prevent credential reuse
- Replace N+1 queries in list_users with single JOIN query

lib/db_sqlite.py

@@ -27,6 +27,7 @@ from lib.db import (
     Q_SELECT_USER_BY_ID,
     Q_SELECT_USER_BY_NAME,
     Q_SELECT_USER_JWT_SECRET,
+    Q_SELECT_USERS_WITH_PERMS,
     Q_SELECT_WEBAUTHN_COUNTS,
     Q_SELECT_WEBAUTHN_ID,
     Q_SELECT_WEBAUTHN_USER,
@@ -70,6 +71,11 @@ class SQLiteBackend(Database):
         Q_SELECT_ALL_USERS: (
             "SELECT id, username, created_at FROM users ORDER BY username"
         ),
+        Q_SELECT_USERS_WITH_PERMS: (
+            "SELECT u.id, u.username, u.created_at, p.subsystem, p.level "
+            "FROM users u LEFT JOIN permissions p ON u.username = p.username "
+            "ORDER BY u.username"
+        ),
         Q_SELECT_USER_JWT_SECRET: ("SELECT jwt_secret FROM users WHERE username = ?"),
         Q_UPDATE_JWT_SECRET: ("UPDATE users SET jwt_secret = ? WHERE username = ?"),
         # Permissions