<?php
declare(strict_types=1);
require __DIR__ . '/app/bootstrap.php';
if (($_SERVER['REQUEST_METHOD'] ?? 'GET') !== 'POST') { http_response_code(405); exit('POST only'); }
verify_csrf();
if (user()) audit('logout','user',(int)user()['id']);
$_SESSION=[];
if (ini_get('session.use_cookies')) { $p=session_get_cookie_params(); setcookie(session_name(),'',time()-42000,$p['path'],$p['domain']??'',(bool)$p['secure'],(bool)$p['httponly']); }
session_destroy();
redirect('login.php');
