Log out with a form and count logouts instead of timing them (part of #256)

Logging out is now a POST in the CSRF-protected route group, sent by a
form on the generator page, so a link or image on another page of the
same site cannot end every login session. The session manager keeps a
count of logouts instead of the time of the latest one: each session
carries the count at its login and is refused once it has changed. No
clock is compared, so a login after a logout always works.

Model: opus-5-5

internal/session/session.go

@@ -40,7 +40,7 @@ type Data struct {
 	ExpiresAt     time.Time `json:"expires"`
 
 	// LogoutCount is the count of logouts when the session was made.
-	LogoutCount int64 `json:"logoutCount"`
+	LogoutCount int64 `json:"logout_count"`
 }
 
 // Manager handles session creation and validation using encrypted cookies.