feat: ADR-080 P1+P2 remediation — refactor, perf, tests, safety

P1 fixes (this sprint):
- P1-6: Extract sensing-server modules (cli, types, csi, pose) from main.rs
- P1-7: DDA ray march for tomography — O(max(n)) replaces O(n^3) voxel scan
- P1-8: Batch neural inference — Tensor::stack/split for single GPU call
- P1-10: Eliminate 112KB/frame alloc — islice replaces deque→list copy

P2 fixes (this quarter):
- P2-11: Python unit tests for 8 modules (rate_limit, auth, error_handler,
  pose_service, stream_service, hardware_service, health_check, metrics)
- P2-13: MAT simulated data safety guard — blocking overlay + pulsing banner
- P2-14: Wire token blacklist into auth verification + logout endpoint
- P2-15: Frame budget benchmark — confirms pipeline well under 50ms budget

Addresses 8 of 10 remaining issues from QE analysis (ADR-080).

Co-Authored-By: claude-flow <ruv@ruv.net>

v1/src/api/routers/auth.py

@@ -0,0 +1,32 @@
+"""
+Authentication router for WiFi-DensePose API.
+Provides logout (token blacklisting) endpoint.
+"""
+
+import logging
+from typing import Optional
+
+from fastapi import APIRouter, Request, HTTPException, status
+
+from src.api.middleware.auth import token_blacklist
+
+logger = logging.getLogger(__name__)
+
+router = APIRouter(prefix="/auth", tags=["auth"])
+
+
+@router.post("/logout")
+async def logout(request: Request):
+    """Logout by blacklisting the current Bearer token."""
+    auth_header = request.headers.get("authorization")
+    if not auth_header or not auth_header.startswith("Bearer "):
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Missing or invalid Authorization header",
+        )
+
+    token = auth_header.split(" ", 1)[1]
+    token_blacklist.add_token(token)
+    logger.info("Token blacklisted via /auth/logout")
+
+    return {"success": True, "message": "Token revoked"}