test: add failing logout test

Red phase: LogoutTest covers deleting existing session and no-op for unknown token.

backend/tests/Unit/Auth/UseCases/LogoutTest.php

@@ -0,0 +1,53 @@
+<?php
+
+namespace Tests\Unit\Auth\UseCases;
+
+use App\Auth\CreateSessionDto;
+use App\Auth\UseCases\Logout\Logout;
+use App\Shared\ValueObject\EmailAddress;
+use App\User\CreateUserDto;
+use DateTimeImmutable;
+use PHPUnit\Framework\TestCase;
+use Tests\Fakes\FakeSessionRepository;
+use Tests\Fakes\FakeUserRepository;
+
+class LogoutTest extends TestCase
+{
+    private FakeSessionRepository $sessionRepo;
+    private Logout $useCase;
+
+    protected function setUp(): void
+    {
+        $this->sessionRepo = new FakeSessionRepository();
+        $this->useCase = new Logout($this->sessionRepo);
+
+        $userRepo = new FakeUserRepository();
+        $user = $userRepo->create(new CreateUserDto(
+            email: new EmailAddress('user@example.com'),
+            passwordHash: 'hashed:password',
+        ));
+
+        $this->sessionRepo->create(new CreateSessionDto(
+            token: 'session-token',
+            user: $user,
+            createdAt: new DateTimeImmutable('2026-05-16 12:00:00'),
+            expiresAt: new DateTimeImmutable('2026-05-23 12:00:00'),
+        ));
+    }
+
+    public function testDeletesSessionByToken(): void
+    {
+        $this->useCase->execute('session-token');
+
+        $this->assertNull(
+            $this->sessionRepo->findByToken('session-token'),
+        );
+    }
+
+    public function testDoesNotThrowForUnknownToken(): void
+    {
+        $this->useCase->execute('nonexistent-token');
+
+        $this->assertTrue(true);
+    }
+}