feat(auth): jti claim and token-revocation store

Stateless JWTs had no revocation path: a stolen token stayed valid for
its full 24h even after the victim changed their password, and there was
no logout. This lays the foundation for revoking them.

- User.tokens_valid_from: per-user bulk-revocation cutoff (compared against
  the token's iat). RevokedToken(jti PK, exp): single-token denylist, pruned
  opportunistically on insert so it never outgrows live-but-revoked tokens.
- login() now mints a jti; create_access_token already stamps iat/exp.
- repo.revoke_token / is_token_revoked / set_tokens_valid_from (abstract +
  shared sqlmodel impl + DummyRepo coverage stubs).
- Centralized validate path in dependencies.py: every auth dependency now
  resolves the user and fails closed on (1) missing jti (legacy/pre-deploy
  token -> one forced re-login), (2) iat before the cutoff, (3) a denylisted
  jti. Denylist lookups ride a 10s membership cache mirroring the user cache.
- Contract/fuzz harness seeds its fixed-uuid principal under
  DECNET_CONTRACT_TEST so its minted token resolves to a live admin user.

decnet/web/db/models/auth.py

@@ -1,6 +1,7 @@
 # SPDX-License-Identifier: AGPL-3.0-or-later
 """Auth + user-management tables and DTOs."""
-from typing import List, Literal
+from datetime import datetime, timezone
+from typing import List, Literal, Optional
 
 from pydantic import BaseModel, Field as PydanticField
 from sqlmodel import Field, SQLModel
@@ -13,6 +14,25 @@ class User(SQLModel, table=True):
     password_hash: str
     role: str = Field(default="viewer")
     must_change_password: bool = Field(default=False)
+    # Bulk session-revocation cutoff: any token whose ``iat`` predates this
+    # instant is rejected. Bumped to "now" on password change, role change,
+    # and admin password reset. NULL means no bulk revocation has occurred.
+    tokens_valid_from: Optional[datetime] = Field(default=None)
+
+
+class RevokedToken(SQLModel, table=True):
+    """A single JWT explicitly revoked via logout, keyed on its ``jti``.
+
+    This denylist holds only explicitly-revoked, not-yet-expired tokens, so it
+    stays tiny — ``revoke_token`` opportunistically prunes rows past expiry on
+    every insert. Bulk "log out everywhere" events use ``User.tokens_valid_from``
+    instead, because there is no per-user registry of live ``jti``s to enumerate.
+    """
+    __tablename__ = "revoked_tokens"
+    jti: str = Field(primary_key=True)
+    user_uuid: str = Field(index=True)  # User.uuid; no FK (independent audit row)
+    expires_at: datetime = Field(index=True)  # token exp; row is prunable past this
+    revoked_at: datetime = Field(default_factory=lambda: datetime.now(timezone.utc))
 
 
 # --- API Request/Response Models (Pydantic) ---