fix: deduplicate token refresh, serialize concurrent attempts, clean up logout path

daemon/handlers/auth.py

@@ -34,7 +34,6 @@ from lib.auth import (
     check_login_rate,
     check_webauthn_rate,
     clear_active_refresh_token,
-    decode_token,
     generate_tokens,
     get_access_ttl,
     validate_token,
@@ -131,14 +130,6 @@ def auth_logout(request: Any, body: Any) -> dict[str, Any]:
     if jti:
         blacklist_token(jti)
 
-    refresh_token = body.get("refresh_token")
-    if refresh_token:
-        payload = decode_token(refresh_token)
-        if payload:
-            refresh_jti = payload.get("jti")
-            if refresh_jti:
-                blacklist_token(refresh_jti, token_type="refresh")
-
     username = body.get("username")
     if username:
         blacklist_active_refresh_token(username)