Add refresh tokens for persistent login, logout button

the main JWT is stored temporarily, whereas the refresh token is stored
as a cookie and can only be used to obtain a new main token. Logout
button adds token to blocklist internally and deletes JWT and refresh
token from browser storage.

api.go

@@ -609,6 +609,11 @@ func (app *appContext) ModifyConfig(gc *gin.Context) {
 	}
 }
 
+func (app *appContext) Logout(gc *gin.Context) {
+	app.invalidIds = append(app.invalidIds, gc.GetString("userId"))
+	gc.JSON(200, map[string]bool{"success": true})
+}
+
 // func Restart() error {
 // 	defer func() {
 // 		if r := recover(); r != nil {