fix(auth): roll back on commit failure in DeleteSession

Restore the rollback-on-commit-failure that v1's Logout handler had before
this session-deletion logic was extracted, so a failed commit does not leave
the transaction open longer than the deferred Close.

pkg/routes/api/shared/auth.go

@@ -200,7 +200,12 @@ func DeleteSession(sid string) error {
 		return err
 	}
 
-	return s.Commit()
+	if err := s.Commit(); err != nil {
+		_ = s.Rollback()
+		return err
+	}
+
+	return nil
 }
 
 // ResetPassword resets a user's password from a previously issued reset token