Does adding immediate logout and refresh token rotation make JWT auth basically session auth?

Pretty much, at least in terms of the server-side checks. Once every request needs a revocation lookup, you have a stateful session-like system. The JWT is still a signed token carrying claims, but it no longer lets you avoid that lookup.

If you don't need the claims to be independently verified by other services, an opaque session token and a server-side session record may be simpler.

There's a useful middle ground. Keep access tokens short-lived and check refresh token state only when refreshing. Per-device logout can invalidate that device's refresh token, but an already issued access token can still work until it expires.

That's not immediate revocation, so the acceptable lifetime depends on your requirements. If a few minutes of residual access is unacceptable, you need an additional revocation check or another way to consult current state on requests.

I wouldn't call JWT and sessions mutually exclusive. JWT describes a token format, while a session is a way to represent an ongoing authenticated relationship. You can use a JWT as part of a stateful session design.

Signed access tokens can still be useful when multiple services need to verify claims without asking a central store on every request. The catch is that immediate revocation brings a current-state check back into that path.

Rotation and device management deserve their own design even if you accept a delay for access-token revocation. Track refresh token state per login or token family, rotate on refresh, and decide what happens when an older token is presented again.

Be careful with concurrent refreshes too. Two legitimate requests using the same refresh token can look like reuse, so the client and server need a clear policy for that case.