chore: sync repository to current working state

Brings azcomputerguru/guru-connect up to the authoritative working copy that
had been maintained in the claudetools monorepo: Phase 1 security and
infrastructure (middleware, metrics, utils, token blacklist, deployment
scripts, security audits) plus the native-remote-control integration spec.
Preserves the repo .gitignore, .cargo, and server/static/downloads.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

server/src/auth/mod.rs

@@ -5,9 +5,11 @@
 
 pub mod jwt;
 pub mod password;
+pub mod token_blacklist;
 
 pub use jwt::{Claims, JwtConfig};
 pub use password::{hash_password, verify_password, generate_random_password};
+pub use token_blacklist::TokenBlacklist;
 
 use axum::{
     extract::FromRequestParts,
@@ -98,6 +100,17 @@ where
             .get::<Arc<JwtConfig>>()
             .ok_or((StatusCode::INTERNAL_SERVER_ERROR, "Auth not configured"))?;
 
+        // Get token blacklist from extensions (set by middleware)
+        let blacklist = parts
+            .extensions
+            .get::<Arc<TokenBlacklist>>()
+            .ok_or((StatusCode::INTERNAL_SERVER_ERROR, "Auth not configured"))?;
+
+        // Check if token is revoked
+        if blacklist.is_revoked(token).await {
+            return Err((StatusCode::UNAUTHORIZED, "Token has been revoked"));
+        }
+
         // Validate token
         let claims = jwt_config
             .validate_token(token)