Session verifier that can be revoked when user terminates their session

## Security Story

### Story context
**SC-23(1)**

- JWTs are valid up to 2 hours
- These cannot be revoked before expiration or after logout

## Risk reduction

- Risk of tokens being compromised
- Risk is reduced by using short-lived tokens (5-15 minutes)
- Add session verifier that can be revoked when a user terminates their session

The issue describes JWT validity, logout, short-lived tokens, and a revocable session verifier, but names no files, tests, or entry points. Start by locating the session and JWT authentication flow in the TypeScript NextJS application; done should include a defined revocation path on session termination and verification that terminated sessions cannot continue using valid tokens.

Written by the indexing model from the issue text.