TokenBlacklistService

Simple in-memory blacklist for JWT tokens to support logout for stateless auth.

Purpose:

• When a user logs out, we can’t “unsign” a JWT. Instead, we remember its value until it naturally expires and reject it on subsequent requests.

Notes:

• Ideal for dev/single-node. In production, use a shared store (Redis) and store a hash of the token.