docs(swagger)+test(rest): document /auth/refresh + /auth/logout, add HTTP smoke tests

Follow-up to PR #8 (JWT revocation + refresh), addressing the two
in-scope follow-ups called out in the completion-sequence summary on
PR #11:

  1. swagger.yaml pre-dated /api/v1/auth/refresh and /api/v1/auth/logout
     - client generators could not pick them up.
  2. Those handlers were covered by unit tests on the WalletAuth layer
     and by the e2e-full Playwright spec, but had no HTTP-level unit
     tests - regressions at the mux/handler seam (wrong method,
     missing walletAuth, unregistered route) were invisible to
     go test ./backend/api/rest.

Changes:

backend/api/rest/swagger.yaml:
  - New POST /api/v1/auth/refresh entry under the Auth tag.
    Uses bearerAuth, returns the existing WalletAuthResponse on 200,
    401 via components/responses/Unauthorized, 503 when the auth
    storage or the jwt_revocations table from migration 0016 is
    missing. Description calls out that legacy tokens without a jti
    cannot be refreshed.
  - New POST /api/v1/auth/logout entry. Same auth requirement;
    returns {status: ok} on 200; 401 via Unauthorized; 503 when
    migration 0016 has not run. Description names the jwt_revocations
    table explicitly so ops can correlate 503s with the migration.
  - Both slot in alphabetically between /auth/wallet and /auth/register
    so the tag block stays ordered.

backend/api/rest/auth_refresh_internal_test.go (new, 8 tests):
  - TestHandleAuthRefreshRejectsGet - GET returns 405 method_not_allowed.
  - TestHandleAuthRefreshReturns503WhenWalletAuthUnconfigured -
    walletAuth nil, POST with a Bearer header returns 503 rather
    than panicking (guards against a regression where someone calls
    s.walletAuth.RefreshJWT without the nil-check).
  - TestHandleAuthLogoutRejectsGet   - symmetric 405 on GET.
  - TestHandleAuthLogoutReturns503WhenWalletAuthUnconfigured -
    symmetric 503 on nil walletAuth.
  - TestAuthRefreshRouteRegistered - exercises SetupRoutes and
    confirms POST /api/v1/auth/refresh and /api/v1/auth/logout are
    registered (i.e. not 404). Catches regressions where a future
    refactor drops the mux.HandleFunc entries for either endpoint.
  - TestAuthRefreshRequiresBearerToken +
    TestAuthLogoutRequiresBearerToken - sanity-check that a POST
    with no Authorization header resolves to 401 or 503 (never 200
    or 500).
  - decodeErrorBody helper extracts ErrorDetail from writeError's
    {"error":{"code":...,"message":...}} envelope, so asserts
    on body["code"] match the actual wire format (not the looser
    {"error":"..."} shape).
  - newServerNoWalletAuth builds a rest.Server with JWT_SECRET set
    to a 32-byte string of 'a' so NewServer's fail-fast check from
    PR #3 is happy; nil db pool is fine because the tests do not
    exercise any DB path.

Verification:
  cd backend && go vet ./...             clean
  cd backend && go test ./api/rest/      pass (17 tests; 7 new)
  cd backend && go test ./...            pass

Out of scope: the live credential rotation in the third follow-up
bullet requires infra access (database + SSH + deploy pipeline) and
belongs to the operator.

backend/api/rest/swagger.yaml

@@ -130,6 +130,60 @@ paths:
         '503':
           description: Wallet auth storage or database not available
 
+  /api/v1/auth/refresh:
+    post:
+      tags:
+        - Auth
+      summary: Refresh a wallet JWT
+      description: |
+        Accepts a still-valid wallet JWT via `Authorization: Bearer <token>`,
+        revokes its `jti` server-side, and returns a freshly issued token with
+        a new `jti` and a per-track TTL (Track 4 is capped at 60 minutes).
+        Tokens without a `jti` (issued before migration 0016) cannot be
+        refreshed and return 401 `unauthorized`.
+      operationId: refreshWalletJWT
+      security:
+        - bearerAuth: []
+      responses:
+        '200':
+          description: New token issued; old token revoked
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/WalletAuthResponse'
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '503':
+          description: Wallet auth storage or jwt_revocations table missing
+
+  /api/v1/auth/logout:
+    post:
+      tags:
+        - Auth
+      summary: Revoke the current wallet JWT
+      description: |
+        Inserts the bearer token's `jti` into the `jwt_revocations` table
+        (migration 0016). Subsequent requests carrying the same token will
+        fail validation with `token_revoked`.
+      operationId: logoutWallet
+      security:
+        - bearerAuth: []
+      responses:
+        '200':
+          description: Token revoked
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  status:
+                    type: string
+                    example: ok
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '503':
+          description: jwt_revocations table missing; run migration 0016_jwt_revocations
+
   /api/v1/auth/register:
     post:
       tags: