Dashboard Logout

Log the user out completely.

Two-step process:

1. Drop the local session cookie (so the hub forgets the user).
2. Redirect to Keycloak's RP-initiated logout endpoint so it tears down the SSO session as well. Otherwise the next "Sign in" click would silently re-authenticate using the surviving Keycloak cookie, never showing the Google/GitHub picker.

When we have a cached id_token (set during login), we pass it as id_token_hint and Keycloak performs the logout silently. Without it (Redis miss, expired TTL, or pre-existing sessions from before this feature), Keycloak shows its built-in "Are you sure?" page — that's the safe fallback, not an error.