fix(import): persist object_key + metadata; add nav + logout session cleanup

- Import task: persist object_key, author, cover_url, genres, summary,
  book_status in PocketBase so the runner can fetch the file and write
  book metadata on completion
- Runner poll mode: pass task.ObjectKey instead of empty string
- Runner: write BookMeta + UpsertBook in Meilisearch after chapter ingest
  so imported books appear in catalogue and search
- Import UI: add author, cover URL, genres, summary, status fields; add
  AI tasks panel (chapter names, description, image gen, tagline) after
  import completes; add AI tasks button on each done task in the list
- Admin nav: add Notifications entry to sidebar (all 5 locales)
- Logout: delete user_sessions row on sign-out so sessions don't
  accumulate as phantoms after each login/logout cycle

ui/src/routes/api/auth/logout/+server.ts

@@ -1,15 +1,24 @@
 import { json } from '@sveltejs/kit';
 import type { RequestHandler } from './$types';
+import { parseAuthToken } from '../../../../hooks.server.js';
+import { deleteSessionByAuthId } from '$lib/server/pocketbase';
 
 const AUTH_COOKIE = 'libnovel_auth';
 
 /**
  * POST /api/auth/logout
- * Clears the auth cookie and returns { ok: true }.
- * Does not revoke the session record from PocketBase —
- * for full revocation use DELETE /api/sessions/[id] first.
+ * Deletes the session row from PocketBase AND clears the auth cookie, so the
+ * session doesn't linger as a phantom "active session" after sign-out.
  */
 export const POST: RequestHandler = async ({ cookies }) => {
+	const token = cookies.get(AUTH_COOKIE);
+	if (token) {
+		const user = parseAuthToken(token);
+		if (user?.authSessionId) {
+			// Best-effort — non-fatal if PocketBase is unreachable.
+			deleteSessionByAuthId(user.authSessionId).catch(() => {});
+		}
+	}
 	cookies.delete(AUTH_COOKIE, { path: '/' });
 	return json({ ok: true });
 };