#842 Back-channel logout: accept identity logout_token, revoke Highway OIDC sessions

EARS SPEC: - When identity POSTs a logout_token to /api/v1/auth/oidc/backchannel-logout, the API shall verify it (RS256 vs their JWKS, iss=identity.rodmena.co.uk, aud=our client_id, exp future, events contains the backchannel-logout URI, REJECT any token carrying nonce) and return 200 on success / 400 on verification failure (never blind 200). - When Highway issues an OIDC session JWT, it shall record the identity sub+sid alongside the email so a logout_token (which carries sub/sid, never email) can be resolved to Highway sessions. - When a verified logout_token arrives, Highway shall revoke the matching session(s): by sid (single device) when present, else by sub (all devices), and the RBAC middleware shall reject revoked OIDC-issued Highway JWTs from that point. - If the logout_token cannot be resolved to any known session, then the endpoint shall still return 200 (idempotent, per OIDC Back-Channel Logout semantics) while logging the unmatched sid. - When implemented, Highway shall reply the registered https URI to identity thread thr-9dbe1df000c8432f8fe2 and verify propagation live (sign in via RODMENA ID, sign out AT identity, observe Highway session rejected). Design notes: Highway JWTs are stateless today - needs sid claim in OIDC-issued JWTs + revocation store (oidc session table via highway-core migration) + middleware check with short cache. Trade-off documented in identity notice 01KYW29QA9J6H7KEEF71KSGBGY: their backchannel fires on logout, password reset/change, device revoke, account-claim - compromise-shaped events where all-device revocation is right. Their stateless-access-token 15-min caveat does not affect us (we never use their access tokens).