feat(auth): implement token revocation via Redis blacklist [REN-72]

[Scott Graham (cheddarfox)]

Summary

• Add TokenBlacklist service (core/auth/blacklist.py) with Redis-backed revoke() and is_revoked() — fail-open design
• Add jti (JWT ID) claim to all tokens for unique identification
• Make verify_token() async with blacklist check before returning valid payload
• Replace placeholder logout endpoint with actual token revocation
• Update all callers of verify_token() (auth middleware, refresh endpoint, test suite)
• 7 tests covering revocation, fail-open, verify rejection, and HTTP logout integration

Test plan

• test_revoke_token_adds_to_blacklist — revoke sets Redis key with TTL
• test_is_revoked_returns_false_for_unknown — non-revoked JTI → False
• test_revoke_expired_token_skips — already-expired token skips Redis
• test_blacklist_fail_open_revoke — Redis down → returns False
• test_blacklist_fail_open_check — Redis down → returns False
• test_verify_token_rejects_revoked — blacklisted token raises HTTPException
• test_logout_revokes_token — POST /auth/logout blacklists the Bearer token

🤖 Generated with Claude Code