feat: add full-stack API persistence and RBAC

app/api/auth/logout/route.ts

@@ -0,0 +1,20 @@
+import { removeCurrentSession } from "@/modules/core/server/auth";
+import { jsonSuccess } from "@/modules/core/server/api";
+import { recordAuditLog } from "@/modules/core/server/audit";
+
+export async function POST(): Promise<Response> {
+  const account = await removeCurrentSession();
+
+  if (account) {
+    await recordAuditLog({
+      actor: account,
+      action: "auth.logout",
+      targetType: "session",
+      result: "success",
+      reason: "退出登录",
+    });
+  }
+
+  return jsonSuccess("已退出登录", {});
+}
+