Sign out also ends the Authentik SSO session (RP-Initiated Logout)

Previously logout only destroyed our own session -- someone who
signed in via Authentik stayed logged into Authentik itself, so
"Sign in with Authentik" again would silently re-authenticate with
no prompt.

Session now tracks authMethod ("local" | "oidc") and, for OIDC
sessions, the raw id_token (needed as id_token_hint at logout time).
New GET /api/auth/oidc/logout redirects through Authentik's
end_session_endpoint (openid-client's buildEndSessionUrl, not
hand-rolled) before landing back on /. Must be a full-page navigation
-- Authentik needs a real browser request to clear its own session
cookie, a fetch() wouldn't do that. Local sessions still use the
existing POST /api/auth/logout unchanged.

Confirmed Authentik has no dedicated post_logout_redirect_uri
allowlist field by checking the provider's DB schema directly before
implementing, rather than assuming.

Closes #19.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docs/oidc-setup.md

@@ -53,7 +53,21 @@ ever unreachable. Routes in `apps/api/src/routes/oidc.ts`:
 
 - `GET /api/auth/oidc/login` — redirects to Authentik's authorization endpoint
 - `GET /api/auth/oidc/callback` — exchanges the code, sets `req.session.username` from
-  the `preferred_username` (falls back to `email`, then `sub`) ID token claim
+  the `preferred_username` (falls back to `email`, then `sub`) ID token claim, and stores
+  `authMethod: "oidc"` + the raw `id_token` in the session
+- `GET /api/auth/oidc/logout` — RP-Initiated Logout (issue #19). Only takes this path if
+  `req.session.authMethod === "oidc"` (a locally-authenticated session has no Authentik
+  session to end); redirects through Authentik's `end_session_endpoint` with
+  `id_token_hint` + `post_logout_redirect_uri` (via `openid-client`'s `buildEndSessionUrl`,
+  not hand-rolled) before landing back on `/`. **Must be a full-page navigation, not a
+  fetch** — the frontend does `window.location.href = ...`, since Authentik needs to see a
+  real browser request to clear its own session cookie on `auth.jerodrigged.com`. Plain
+  `POST /api/auth/logout` still exists for local sessions and just clears the local one.
+
+Authentik has no dedicated `post_logout_redirect_uri` allowlist field (unlike
+`redirect_uris`) as of the version this was built against — confirmed by checking the
+provider's DB schema (`\d authentik_providers_oauth2_oauth2provider`) before
+implementing, not assumed.
 
 ## Credentials