docs: AUTH-003 documents unreachable 500 status code — logout handler always returns 204

[evan-zhang11]

Documentation Inaccuracy

Entry: AUTH-003 (登出)
Documented status codes: 204 / 500
Actual behavior: Always returns 204 No Content

Details

The logout handler in auth_routes.rs intentionally ignores session logout errors:

async fn logout(mut auth_session: AuthSession<crate::AuthBackend>) -> impl IntoResponse {
    // Always return 204 NO_CONTENT, even if session is already deleted/expired
    // The end state (user logged out) is correct regardless of deletion result
    let _ = auth_session.logout().await;
    StatusCode::NO_CONTENT
}

The 500 status code documented in AUTH-003 is unreachable — the handler never returns it. The let _ pattern explicitly swallows any errors from auth_session.logout().

Impact

• Low: Minor documentation inaccuracy, no functional impact
• Tests or clients expecting a 500 response would never receive one
• Could cause confusion for developers reading the documentation

Suggested Fix

Option A (recommended — match reality): Update AUTH-003 documented status codes to 204 only, add note that logout is idempotent and always succeeds.

Option B (change code): If 500 is actually desired for internal errors, wrap the logout call in proper error handling.

Context

• Discovered during daily documentation review (2026-07-31)