fix auth: validate logout body, harden WebAuthn, optimize list_users

- Raise ValueError on missing request body in auth_logout
- Add username check in verify_authentication to prevent credential reuse
- Replace N+1 queries in list_users with single JOIN query

lib/webauthn.py

@@ -324,6 +324,9 @@ def verify_authentication(
         raise ValueError("Credential not found")
 
     cred_row = cred_rows[0]
+    if cred_row["username"] != username:
+        raise ValueError("Credential not found")
+
     public_key = b64u_decode(cred_row["public_key"])
     old_sign_count = cred_row["sign_count"]