fix(api): drop redundant dev-deps; fix server AppState for cookie_secure; add logout + illegal-transition tests

crates/server/src/lib.rs

@@ -20,6 +20,8 @@ pub async fn run(config: Config) -> anyhow::Result<()> {
     let state = AppState {
         db,
         app_name: config.app_name.clone(),
+        // Wired to config in the auth CLI task; Secure by default.
+        cookie_secure: true,
     };
 
     let listener = TcpListener::bind(&config.bind_addr)