Fix logout auth and token revocation

[sip-21]

Configurable access token expiration with optimized test speed

Added command-line configuration for access token expiration to enable
faster E2E tests while maintaining production defaults.

Server Changes (Kotlin)

TokenService.kt

• Made accessTokenExpirationSeconds configurable via application config
• Default: 60 seconds (production)
• Reads from jwt.accessTokenExpirationSeconds property

Ambrosia.kt

• Added --jwt-access-token-expiration CLI option (default: "60")
• Passes option value to application config

Authorize.kt

• Updated /login and /refresh cookie expiration to use
  tokenService.accessTokenExpirationSeconds instead of hardcoded 60s
• Wrapped /logout endpoint in authenticate("auth-jwt") for proper
  authentication (security improvement)

Test Changes (Python)

test_server.py

• Configured E2E tests to use 5-second token expiration via
  --jwt-access-token-expiration 5 for faster test runs
• Added command logging for troubleshooting

test_auth_e2e.py

• Renamed test_access_token_expires_after_one_minute to test_access_token_expiration_and_refresh updated the test to wait 8 seconds
  instead of 65 seconds
• Removed manual cookie workarounds (httpx handles automatically)
• Updated test_logout_revokes_tokens to expect proper authentication

test_routing_e2e.py

• Added test_logout_revokes_tokens to verify server-side token
  revocation (70 lines)

Results

• Test suite runs in ~15 seconds (was ~80 seconds) - 5.3× faster
• Production behavior unchanged (60-second default)
• Improved security: logout now requires authentication
• Cleaner test code: removed 44 lines of manual cookie handling

Configuration

Production (default):
--jwt-access-token-expiration 60

Testing (E2E):
--jwt-access-token-expiration 5

[sip-21]

Postpone this for after the workshop presentation!

[sip-21]

Done.