Log out with a form and count logouts instead of timing them (part of #256)

Logging out is now a POST in the CSRF-protected route group, sent by a
form on the generator page, so a link or image on another page of the
same site cannot end every login session. The session manager keeps a
count of logouts instead of the time of the latest one: each session
carries the count at its login and is refused once it has changed. No
clock is compared, so a login after a logout always works.

Model: opus-5-5

internal/db/migrations/001_schema.sql

@@ -177,9 +177,11 @@ CREATE TABLE IF NOT EXISTS cache_stats (
 );
 INSERT OR IGNORE INTO cache_stats (id) VALUES (1);
 
--- Time of the latest logout. A login session made before it is refused,
--- so logging out ends every login session. No row: nobody has logged out.
+-- Count of logouts. Each logout adds one; a login session carries the count
+-- at its login and is refused once the count has changed, so logging out ends
+-- every login session.
 CREATE TABLE IF NOT EXISTS logout (
     id INTEGER PRIMARY KEY CHECK (id = 1),
-    logged_out_at DATETIME NOT NULL
+    logout_count INTEGER NOT NULL DEFAULT 0
 );
+INSERT OR IGNORE INTO logout (id) VALUES (1);