Replace the count of logouts with a random value (part of #256)

The session manager now keeps a random value from crypto/rand in the
logout table, made when the table has none and replaced by each logout.
A session carries the value current at its login and is refused when it
differs. A lost state directory now ends every login session, and no
logout can make an ended one work again, as a count starting from 0
could. README.md and the Manager doc comment say the check for a logout
compares no time, while a session's expiry still compares the clock.

Model: opus-5-5

README.md

@@ -71,10 +71,10 @@ The state directory (`state_dir`, `/var/lib/pixa` in the container) holds the
 database and the disk cache:
 
 - It needs a persistent volume: without one, every restart starts with an empty
-  cache and forgets the count of logouts, so login sessions that a logout ended
-  can work again (see Encrypted URLs). In the container, the startup script
-  gives the directory to the user pixa runs as (uid 65532) and sets its mode to
-  `750`; outside it, that user must be able to write the directory.
+  cache. Losing the directory also ends every login session (see Encrypted
+  URLs). In the container, the startup script gives the directory to the user
+  pixa runs as (uid 65532) and sets its mode to `750`; outside it, that user
+  must be able to write the directory.
 - `cache_max_bytes` limits the source and transformed images together. The
   database, the metadata files, the `.meta` file beside each transformed image
   and files still being written come on top, and eviction runs in the
@@ -382,11 +382,12 @@ nor change what it asks for.
    lasts 30 days, or until someone logs out with the generator page's Logout
    button. Every login is made with the one signing key, so logging out ends
    every login session, in every browser, a copy of the session cookie included.
-   pixa keeps a count of logouts in its database: each logout adds one, a login
-   session carries the count at its login, and a login session whose count is
-   not the current one is refused, also after a restart that keeps the state
-   directory (see Deployment). No time is compared, so a login after a logout
-   works whatever the host's clock says.
+   pixa keeps a random value in its database, which it makes when the database
+   has none and replaces at each logout. A login session carries the value
+   current at its login and is refused once the value has changed, also after a
+   restart (see Deployment). The check for a logout compares no time, so a login
+   after a logout works whatever the host's clock says; the 30 days are still
+   measured by the host's clock.
 2. On the generator page, give the source image's URL, the width and height, the
    format, quality and fit, and how long the URL lasts, then submit the form
    (`POST /generate`). The format is JPEG XL unless another is chosen; a form