fix: logout supprime access_token cookie + bouton toujours visible

- Backend: delete_cookie access_token (/) + refresh_token
- Logout ne requiert plus auth (graceful si token expire)
- Bouton Deconnexion toujours visible dans le menu

backend/auth/router.py

@@ -217,18 +217,21 @@ async def refresh_token_endpoint(request: Request, response: Response):
 async def logout(
     request: Request,
     response: Response,
-    current_user=Depends(require_auth),
 ):
-    """Logout: revoke refresh token and delete cookie."""
+    """Logout: revoke refresh token and delete cookies."""
     refresh_tok = request.cookies.get("refresh_token")
     if refresh_tok:
         payload = decode_token(refresh_tok)
         if payload:
-            revoke_token(payload["jti"])
+            try:
+                revoke_token(payload["jti"])
+            except Exception:
+                pass  # token already revoked
 
     response.delete_cookie("refresh_token", path="/api/auth/refresh")
-    logger.info(f"User '{current_user['username']}' logged out")
-    return {"message": "Déconnecté avec succès"}
+    response.delete_cookie("access_token", path="/")
+    response.delete_cookie("access_token", path="/api")  # just in case
+    return {"message": "Deconnecte avec succes"}
 
 
 @router.get("/me")