sdyl405w4: Remove the sign-out feature and the Minnect revoke call

src/app/api/session/route.ts

@@ -1,13 +1,14 @@
 import { NextResponse, type NextRequest } from "next/server";
 import { loginToMinnect, LoginError } from "@/lib/minnect";
 import { createSession, getSession } from "@/lib/session-store";
-import { endSession } from "@/lib/session-refresh";
 import { SESSION_COOKIE, sessionCookieOptions } from "@/lib/cookie";
 
 // This route holds the session on the server. The browser talks only to this
 // app; Minnect tokens never leave the server (ADR-001).
 //
-// POST signs in, GET says who the person is, DELETE signs out (revoke + clear).
+// POST signs in, GET says who the person is. There is no sign-out: the session ends
+// when the server restarts or the cookie is cleared, and Minnect's revoke endpoint
+// is never called (the refresh token is shared across the person's devices).
 // The reusable token-refresh logic lives in session-refresh.ts for the feed
 // route (a later task) to call before it uses a token.
 
@@ -91,21 +92,3 @@ export async function GET(req: NextRequest) {
     feedUserId: session.person.feedUserId ?? null,
   });
 }
-
-/**
- * DELETE /api/session
- * Sign out: revoke the refresh token at Minnect (best-effort), delete the
- * server session, and clear the cookie. Always returns 200: sign-out succeeds
- * even when revoke errors. After this, the session is gone, so every
- * token-requiring route (and GET /api/session) returns 401 { error: "sign_in" }.
- */
-export async function DELETE(req: NextRequest) {
-  const sessionId = req.cookies.get(SESSION_COOKIE)?.value;
-
-  await endSession(sessionId);
-
-  const res = NextResponse.json({ ok: true });
-  // Expire the cookie with the same attributes it was set with.
-  res.cookies.set(SESSION_COOKIE, "", { ...sessionCookieOptions(), maxAge: 0 });
-  return res;
-}