Add activity logs, sidebar badges, and logout with working alert colors.

Record auth audits and surface them in Activity, poll sidebar counts without resetting idle, and add a profile logout path plus theme red/green/blue tokens so failure badges render.

service/internal/auth/session.go

@@ -87,11 +87,15 @@ func (manager *SessionManager) CreateSession(
 	return record, nil
 }
 
-// LookupValidSession finds a non-expired, non-idle session and may rotate it.
+// LookupValidSession finds a non-expired, non-idle session.
+// When touchActivity is true, LastSeenAt is updated and the session may rotate.
+// When touchActivity is false, the session is validated only (no LastSeenAt update,
+// rotation, or sessions file write unless the session is being destroyed as idle/expired).
 func (manager *SessionManager) LookupValidSession(
 	writer http.ResponseWriter,
 	request *http.Request,
 	security settings.SecuritySettings,
+	touchActivity bool,
 ) (settings.SessionRecord, error) {
 	cookie, err := request.Cookie(SessionCookieName)
 	if err != nil || strings.TrimSpace(cookie.Value) == "" {
@@ -140,6 +144,10 @@ func (manager *SessionManager) LookupValidSession(
 		return settings.SessionRecord{}, ErrSessionNotFound
 	}
 
+	if !touchActivity {
+		return *found, nil
+	}
+
 	shouldRotate := now.Sub(found.CreatedAt) >= sessionRotateAfter ||
 		now.Sub(found.CreatedAt) >= lifetime/2