feat: ADR-080 P1+P2 remediation — refactor, perf, tests, safety

P1 fixes (this sprint):
- P1-6: Extract sensing-server modules (cli, types, csi, pose) from main.rs
- P1-7: DDA ray march for tomography — O(max(n)) replaces O(n^3) voxel scan
- P1-8: Batch neural inference — Tensor::stack/split for single GPU call
- P1-10: Eliminate 112KB/frame alloc — islice replaces deque→list copy

P2 fixes (this quarter):
- P2-11: Python unit tests for 8 modules (rate_limit, auth, error_handler,
  pose_service, stream_service, hardware_service, health_check, metrics)
- P2-13: MAT simulated data safety guard — blocking overlay + pulsing banner
- P2-14: Wire token blacklist into auth verification + logout endpoint
- P2-15: Frame budget benchmark — confirms pipeline well under 50ms budget

Addresses 8 of 10 remaining issues from QE analysis (ADR-080).

Co-Authored-By: claude-flow <ruv@ruv.net>

v1/src/api/main.py

@@ -17,7 +17,7 @@ from starlette.exceptions import HTTPException as StarletteHTTPException
 
 from src.config.settings import get_settings
 from src.config.domains import get_domain_config
-from src.api.routers import pose, stream, health
+from src.api.routers import pose, stream, health, auth
 from src.api.middleware.auth import AuthMiddleware
 from src.api.middleware.rate_limit import RateLimitMiddleware
 from src.api.dependencies import get_pose_service, get_stream_service, get_hardware_service
@@ -263,6 +263,12 @@ app.include_router(
     tags=["Streaming"]
 )
 
+app.include_router(
+    auth.router,
+    prefix=f"{settings.api_prefix}",
+    tags=["Authentication"]
+)
+
 
 # Root endpoint
 @app.get("/")

v1/src/api/middleware/auth.py

@@ -189,7 +189,11 @@ class AuthMiddleware(BaseHTTPMiddleware):
                 self.settings.secret_key,
                 algorithms=[self.settings.jwt_algorithm]
             )
-            
+
+            # Check token blacklist (logout invalidation)
+            if token_blacklist.is_blacklisted(token):
+                raise ValueError("Token has been revoked")
+
             # Extract user information
             user_id = payload.get("sub")
             if not user_id:

v1/src/api/routers/__init__.py

@@ -2,6 +2,6 @@
 API routers package
 """
 
-from . import pose, stream, health
+from . import pose, stream, health, auth
 
-__all__ = ["pose", "stream", "health"]
+__all__ = ["pose", "stream", "health", "auth"]

v1/src/api/routers/auth.py

@@ -0,0 +1,32 @@
+"""
+Authentication router for WiFi-DensePose API.
+Provides logout (token blacklisting) endpoint.
+"""
+
+import logging
+from typing import Optional
+
+from fastapi import APIRouter, Request, HTTPException, status
+
+from src.api.middleware.auth import token_blacklist
+
+logger = logging.getLogger(__name__)
+
+router = APIRouter(prefix="/auth", tags=["auth"])
+
+
+@router.post("/logout")
+async def logout(request: Request):
+    """Logout by blacklisting the current Bearer token."""
+    auth_header = request.headers.get("authorization")
+    if not auth_header or not auth_header.startswith("Bearer "):
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Missing or invalid Authorization header",
+        )
+
+    token = auth_header.split(" ", 1)[1]
+    token_blacklist.add_token(token)
+    logger.info("Token blacklisted via /auth/logout")
+
+    return {"success": True, "message": "Token revoked"}