new system prototype

api/logout.php

@@ -0,0 +1,21 @@
+<?php
+require_once __DIR__ . '/../common.php';
+require_once __DIR__ . '/../db_init.php';
+
+header('Content-Type: application/json; charset=UTF-8');
+
+if ($_SERVER['REQUEST_METHOD'] !== 'DELETE' && $_SERVER['REQUEST_METHOD'] !== 'POST') {
+    http_response_code(405);
+    echo json_encode(["error" => "Method not allowed"]);
+    exit;
+}
+
+$token = get_bearer_token();
+if (!$token) {
+    http_response_code(401);
+    echo json_encode(["error" => "Missing Bearer token"]);
+    exit;
+}
+
+token_revoke($token);
+echo json_encode(["success" => true]);