feat(ECR-010): Ops-E 系统运营；修复登出解绑；P2 Complete

落地管理员 RBAC/封禁/推送任务 stub，logout 解绑 device 并统一各页 ensureAccount，同时收口 P2 生日生成与状态文档。

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/internal/service/auth/service.go

@@ -93,12 +93,15 @@ func (s *Service) OpenLogin(ctx context.Context, deviceUserID uuid.UUID, deviceK
 	return s.issue(ctx, uid, phone, nickname)
 }
 
-// Logout revokes bearer token.
-func (s *Service) Logout(ctx context.Context, token string) error {
-	if token == "" {
-		return nil
+// Logout revokes the current bearer session and unbinds the device from the account
+// so a refresh no longer resolves as logged-in via X-Device-Key (Spec R5).
+func (s *Service) Logout(ctx context.Context, token, deviceKey string) error {
+	if token != "" {
+		if err := s.Repo.RevokeSession(ctx, token); err != nil {
+			return err
+		}
 	}
-	return s.Repo.RevokeSession(ctx, token)
+	return s.Repo.RebindDeviceAnonymous(ctx, deviceKey)
 }
 
 // Me returns account if registered.