testing 127.0.0.1 issue

Signed-off-by: Kenneth Obsequio <k80308392@gmail.com>

services/trustedDevice.service.js

@@ -6,9 +6,14 @@
  *              OTP; trust rolls forward 30 days on each trusted login and is
  *              tied to both an opaque cookie token (device_trust) and a
  *              User-Agent fingerprint, so a stolen cookie alone isn't enough
- *              once the fingerprint no longer matches. Trust is revoked on
- *              logout, password change/reset, admin ban/deactivate, or a
- *              single session being terminated.
+ *              once the fingerprint no longer matches. Ordinary logout does
+ *              NOT revoke trust or clear the device_trust cookie — expires_at
+ *              is the only thing that ends the OTP-skip window in the normal
+ *              case, so logging out and back in on the same device still
+ *              skips OTP until the 30-day window actually lapses. Trust is
+ *              only force-revoked by password change/reset, admin ban/
+ *              deactivate/force-logout, or a single session being explicitly
+ *              terminated.
  * Author: Kenneth Obsequio
  * Date Created: Jul. 5, 2026
  ***********************************************************************************************************************************************************************
@@ -103,6 +108,12 @@ const issueOrRefresh = async (res, userId, fingerprintHash, sessionId) => {
   }
 };
 
+/**
+ * Revokes trust for one specific device by its cookie token. Not called by
+ * the normal logout flow (see auth.controller.js exports.logout) — ordinary
+ * logout intentionally leaves trust intact. Kept as a primitive for a
+ * future explicit "forget this device" action, should one be added.
+ */
 const revokeByToken = async (userId, rawToken) => {
   if (!rawToken) return;
   try {