Add refresh tokens for persistent login, logout button

the main JWT is stored temporarily, whereas the refresh token is stored
as a cookie and can only be used to obtain a new main token. Logout
button adds token to blocklist internally and deletes JWT and refresh
token from browser storage.

main.go

@@ -42,6 +42,7 @@ type appContext struct {
 	bsVersion        int
 	jellyfinLogin    bool
 	users            []User
+	invalidIds       []string
 	jf               Jellyfin
 	authJf           Jellyfin
 	datePattern      string
@@ -328,6 +329,7 @@ func main() {
 		router.Use(static.Serve("/invite/", static.LocalFile(filepath.Join(app.local_path, "static"), false)))
 		router.GET("/invite/:invCode", app.InviteProxy)
 		api := router.Group("/", app.webAuth())
+		api.POST("/logout", app.Logout)
 		api.POST("/generateInvite", app.GenerateInvite)
 		api.GET("/getInvites", app.GetInvites)
 		api.POST("/setNotify", app.SetNotify)