feat(ECR-010): Ops-E 系统运营；修复登出解绑；P2 Complete

落地管理员 RBAC/封禁/推送任务 stub，logout 解绑 device 并统一各页 ensureAccount，同时收口 P2 生日生成与状态文档。

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/internal/integration/auth_logout_test.go

@@ -0,0 +1,25 @@
+package integration_test
+
+import (
+	"net/http"
+	"testing"
+)
+
+// Logout must revoke session AND unbind device so refresh is not still "logged in".
+func TestAuthLogoutUnbindsDevice(t *testing.T) {
+	r, _ := setupAPI(t)
+	key := mustRegister(t, r)
+
+	_, key = doJSON(t, r, http.MethodGet, "/api/v1/auth/me", nil, key)
+
+	_, key = doJSON(t, r, http.MethodPost, "/api/v1/auth/logout", nil, key)
+	testBearer = ""
+
+	_, _, status := doJSONExpect(t, r, http.MethodGet, "/api/v1/auth/me", nil, key, 40112)
+	if status != http.StatusUnauthorized {
+		t.Fatalf("after logout GET /auth/me want HTTP 401, got %d", status)
+	}
+
+	_, key, _ = doJSONExpect(t, r, http.MethodGet, "/api/v1/profiles", nil, key, 40112)
+	_ = key
+}