Add thread-safe in-memory token revocation to fix the critical issue
where logged-out or password-reset tokens remain valid until expiry.
- Add jti (uuid v4) to all issued tokens for single-token revocation
- Add per-user version number for bulk revocation on password reset
- Add jti blacklist with TTL-based auto-cleanup to prevent memory leaks
- Introduce unified verify_token() replacing 4 copies of inline logic
- Refactor all handlers (login/logout/refresh/reset_password/proxy/whoami/
admin_verify/ws_admin) to use the new verification pipeline
- Refresh token now revokes old jti (prevents replay after refresh)
- Bump version to 0.8.0
qing
5dc8956b55