fix(phase7): resolve remaining TODOs - session_id in JWT and repository injection

apps/api/app/api/routes/auth.py

@@ -1,7 +1,7 @@
 """
 认证 API 路由
 """
-from fastapi import APIRouter, HTTPException, status, Depends
+from fastapi import APIRouter, HTTPException, status, Depends, Request
 from pydantic import BaseModel, EmailStr
 
 from packages.application.auth import (
@@ -145,6 +145,7 @@ async def login(request: LoginRequestModel):
 
 @router.post("/logout", status_code=status.HTTP_204_NO_CONTENT)
 async def logout(
+    request: Request,
     logout_all_devices: bool = False,
     current_user: User = Depends(get_current_user),
 ):
@@ -157,9 +158,23 @@ async def logout(
     container = get_container()
     use_case = container.get_logout_use_case()
     
+    # 从 JWT token 中提取 session_id
+    from packages.domain.auth import jwt_service
+    
+    # 从 request 中获取 token
+    auth_header = request.headers.get("Authorization")
+    session_id = None
+    if auth_header and auth_header.startswith("Bearer "):
+        token = auth_header[7:]  # 移除 "Bearer " 前缀
+        try:
+            payload = jwt_service.verify_token(token)
+            session_id = payload.get("sid")  # 从 payload 提取 session_id
+        except:
+            pass  # token 无效或没有 session_id，继续使用 None
+    
     req = LogoutRequest(
         user_id=current_user.id,
-        session_id=None,  # TODO: 从 token 中获取 session_id
+        session_id=session_id,
         logout_all_devices=logout_all_devices,
     )