fix: deduplicate token refresh, serialize concurrent attempts, clean up logout path

lib/auth_users.py

@@ -263,8 +263,10 @@ def delete_user(username: str) -> bool:
     if user is None:
         raise ValueError(f"User {username!r} not found")
 
+    blacklist_active_refresh_token(username)
     db = get_db()
     db.run(Q_DELETE_USER, (username,))
+    _cleanup_blacklist()
     return True