Log out with a form and count logouts instead of timing them (part of #256)

Logging out is now a POST in the CSRF-protected route group, sent by a
form on the generator page, so a link or image on another page of the
same site cannot end every login session. The session manager keeps a
count of logouts instead of the time of the latest one: each session
carries the count at its login and is refused once it has changed. No
clock is compared, so a login after a logout always works.

Model: opus-5-5

TODO.md

@@ -76,6 +76,22 @@ P2: security: per-origin rate limiting
   405, or a CORS preflight. The metrics library takes the label before the
   request is routed, so the metrics middleware asks the router which route
   matches.
+- 2026-10-15 logging out ends every login session (closes #256): a login session
+  was a cookie with nothing kept on the server, so `/logout` removed it from one
+  browser and a copy of it kept working for its 30 days. Every login is made
+  with the one signing key, so logging out now ends them all: the session
+  manager counts logouts, saves the count in the new `logout` table so that it
+  outlasts a restart, puts the count at login in each session, and refuses a
+  session whose count is not the current one. No time is compared, so a login
+  after a logout works whatever the host's clock does. A restart without a
+  persistent volume for the state directory forgets the count. Logging out is
+  now `POST /logout` from a form on the generator page, behind the CSRF check
+  the other forms have, so a link or image elsewhere on the same site cannot end
+  the sessions. A logout without a valid login session ends none and only
+  removes the cookie, as anyone can take a CSRF token from the login page. A
+  logout that cannot be saved answers 500. `session.NewManager`, which the tests
+  use, keeps the count in memory only; pixad uses
+  `session.NewManagerWithDatabase`.
 - 2026-10-15 expired negative cache rows are removed on a schedule (closes
   #244): the row of a failed fetch, which makes pixa answer 502 for that source
   URL for 5 minutes, was deleted only when the same URL was requested again
@@ -116,18 +132,6 @@ P2: security: per-origin rate limiting
   and the query now have each `%` written as `%25` and each `:` as `%3A`; a path
   and query holding neither are signed and keyed as before. Signature
   Specification in `README.md` says so.
-- 2026-10-15 logging out ends every login session (closes #256): a login session
-  was a cookie with nothing kept on the server, so `/logout` removed it from one
-  browser and a copy of it kept working for its 30 days. Every login is made
-  with the one signing key, so `/logout` now ends them all: the session manager
-  keeps the time of the latest logout, saves it in the new `logout` table so
-  that it outlasts a restart, and refuses a session made before it. A restart
-  without a persistent volume for the state directory forgets it. A `/logout`
-  without a valid login session, such as one another site makes a browser send
-  without the `SameSite=Strict` cookie, ends none and only removes the cookie. A
-  logout that cannot be saved answers 500. `session.NewManager`, which the tests
-  use, keeps logouts in memory only; pixad uses
-  `session.NewManagerWithDatabase`.
 - 2026-10-15 the example config allowlists no host (closes #249): it allowlisted
   `github.com` and `user-images.githubusercontent.com`, where anyone can put an
   image, so a deployment set up as Getting Started says served those images to