chore: add logout-all-users recovery script

[cdtinney]

Summary

Adds scripts/logout-all-users.sh, run on the droplet to clear the session table when stale cookies point at user rows the server can't deserialize.

Concretely: after the token-encryption rollout in #204, pre-existing user rows still hold plaintext access/refresh tokens. The new decryptToken path requires a v1: prefix and throws on anything else, so passport's deserializeUser (which calls findUserBySpotifyId → toUser) throws on every authenticated request — including /api/auth/user/logout. The user has no in-app way to recover.

Wiping the session table breaks the cookie → user mapping. The next request runs the OAuth flow, and findOrCreateUser's ON CONFLICT … DO UPDATE rewrites both token columns with freshly-encrypted (v1:-prefixed) values, so the stale rows fix themselves on next login. No need to touch the users table.

Hardcoded to /opt/spune/docker-compose.yml to match migrate.sh / logs.sh. Uses DELETE over TRUNCATE (works under any privilege level, transactional). Confirmation prompt by default; --yes to skip.

Testing

• bash -n scripts/logout-all-users.sh — syntax check passes.
• Manually traced the recovery flow: empty session table → next request has no passport.user on req.session → passport doesn't call deserializeUser → no decrypt error → /api/auth/spotify redirect works → callback runs findOrCreateUser → row rewritten with v1: tokens.