Say that losing the state directory forgets the latest logout (part of #256)

The state directory bullet in README.md and the session package doc now
say that the time of the latest logout is kept in the database, which a
restart without a persistent volume loses.

Model: opus-5-5

README.md

@@ -71,9 +71,10 @@ The state directory (`state_dir`, `/var/lib/pixa` in the container) holds the
 database and the disk cache:
 
 - It needs a persistent volume: without one, every restart starts with an empty
-  cache. In the container, the startup script gives the directory to the user
-  pixa runs as (uid 65532) and sets its mode to `750`; outside it, that user
-  must be able to write the directory.
+  cache and forgets the latest logout, so the login sessions that logout ended
+  work again (see Encrypted URLs). In the container, the startup script gives
+  the directory to the user pixa runs as (uid 65532) and sets its mode to `750`;
+  outside it, that user must be able to write the directory.
 - `cache_max_bytes` limits the source and transformed images together. The
   database, the metadata files, the `.meta` file beside each transformed image
   and files still being written come on top, and eviction runs in the
@@ -360,7 +361,7 @@ nor change what it asks for.
    with the one signing key, so logging out ends every login session, in every
    browser: pixa saves the time of the latest logout in its database and refuses
    a login session made before it, a copy of the session cookie included, also
-   after a restart.
+   after a restart that keeps the state directory (see Deployment).
 2. On the generator page, give the source image's URL, the width and height, the
    format, quality and fit, and how long the URL lasts, then submit the form
    (`POST /generate`). The format is JPEG XL unless another is chosen; a form

TODO.md

@@ -70,6 +70,18 @@ P2: security: per-origin rate limiting
   and the query now have each `%` written as `%25` and each `:` as `%3A`; a path
   and query holding neither are signed and keyed as before. Signature
   Specification in `README.md` says so.
+- 2026-10-15 logging out ends every login session (closes #256): a login session
+  was a cookie with nothing kept on the server, so `/logout` removed it from one
+  browser and a copy of it kept working for its 30 days. Every login is made
+  with the one signing key, so `/logout` now ends them all: the session manager
+  keeps the time of the latest logout, saves it in the new `logout` table so
+  that it outlasts a restart, and refuses a session made before it. A restart
+  without a persistent volume for the state directory forgets it. A `/logout`
+  without a valid login session, such as one another site makes a browser send
+  without the `SameSite=Strict` cookie, ends none and only removes the cookie. A
+  logout that cannot be saved answers 500. `session.NewManager`, which the tests
+  use, keeps logouts in memory only; pixad uses
+  `session.NewManagerWithDatabase`.
 - 2026-10-15 the example config allowlists no host (closes #249): it allowlisted
   `github.com` and `user-images.githubusercontent.com`, where anyone can put an
   image, so a deployment set up as Getting Started says served those images to
@@ -87,17 +99,6 @@ P2: security: per-origin rate limiting
   answered 500. Once the limit is used up, the fetcher now reads one more byte:
   if the body has ended it is accepted, and if there is more it is refused with
   `ErrResponseTooLarge`, as before.
-- 2026-10-15 logging out ends every login session (closes #256): a login session
-  was a cookie with nothing kept on the server, so `/logout` removed it from one
-  browser and a copy of it kept working for its 30 days. Every login is made
-  with the one signing key, so `/logout` now ends them all: the session manager
-  keeps the time of the latest logout, saves it in the new `logout` table so
-  that it outlasts a restart, and refuses a session made before it. A `/logout`
-  without a valid login session, such as one another site makes a browser send
-  without the `SameSite=Strict` cookie, ends none and only removes the cookie. A
-  logout that cannot be saved answers 500. `session.NewManager`, which the tests
-  use, keeps logouts in memory only; pixad uses
-  `session.NewManagerWithDatabase`.
 - 2026-10-13 `fit=outside` no longer makes an output above 8192 on a side
   (closes #257): it scales the image to cover the requested size, and the side
   scaled past that size was held to no maximum, so `1x8192?fit=outside` of a

internal/session/session.go

@@ -1,4 +1,6 @@
-// Package session provides encrypted session cookie management.
+// Package session provides encrypted session cookie management, and keeps the
+// time of the latest logout in the database so that a logout ends every
+// session made before it.
 package session
 
 import (