Logout now requires Authorization: Bearer <access-token>.

backend/app/api/auth.py

@@ -3,7 +3,7 @@
 
 from uuid import uuid4
 
-from fastapi import APIRouter, Depends, HTTPException, Request
+from fastapi import APIRouter, Depends, Header, HTTPException, Request
 from pydantic import BaseModel
 
 from backend.app.api.dependencies import get_current_user
@@ -119,10 +119,12 @@ def reset_password_endpoint(payload: PasswordResetRequest):
 
 
 @router.post('/logout')
-def logout(payload: dict):
-    token = payload.get('token')
+def logout(authorization: str | None = Header(default=None)):
+    if not authorization or not authorization.startswith('Bearer '):
+        raise HTTPException(status_code=401, detail='Missing or invalid Authorization header')
+    token = authorization.replace('Bearer ', '', 1).strip()
     if not token:
-        raise HTTPException(status_code=400, detail='Token is required')
+        raise HTTPException(status_code=401, detail='Missing or invalid Authorization header')
     revoked = revoke_token(token)
     if not revoked:
         raise HTTPException(status_code=404, detail='Token not found or already revoked')