Log out with a form and count logouts instead of timing them (part of #256)

Logging out is now a POST in the CSRF-protected route group, sent by a
form on the generator page, so a link or image on another page of the
same site cannot end every login session. The session manager keeps a
count of logouts instead of the time of the latest one: each session
carries the count at its login and is refused once it has changed. No
clock is compared, so a login after a logout always works.

Model: opus-5-5

internal/handlers/handlers.go

@@ -164,7 +164,8 @@ func (s *Handlers) initImageService() error {
 
 	// Initialize session manager (signing key is validated at config load
 	// time). Session cookies are always Secure/HttpOnly/SameSite=Strict.
-	// Logouts are saved in the database, so they outlast a restart.
+	// The count of logouts is saved in the database, so it outlasts a
+	// restart.
 	sessMgr, err := session.NewManagerWithDatabase(
 		context.Background(), s.config.SigningKey, s.db.DB())
 	if err != nil {