refactor(auth): replace redirectToPortalLogin with redirectToPortalLogout

Updated authentication flow to use redirectToPortalLogout instead of redirectToPortalLogin in NavUser and AppearanceSettingsPage components. Introduced redirectToPortalLogout function to handle SSO session termination and redirect users to the logout URL.

apps/web/src/components/nav-user.tsx

@@ -38,7 +38,7 @@ import {
   clearToken,
   getClaims,
   isAuthEnabled,
-  redirectToPortalLogin,
+  redirectToPortalLogout,
   resetPortalHandoff,
 } from '@/lib/auth'
 
@@ -130,7 +130,7 @@ export function NavUser() {
     clearToken()
     resetPortalHandoff()
     if (authOn) {
-      redirectToPortalLogin()
+      redirectToPortalLogout()
       return
     }
     window.location.href = '/login'

apps/web/src/lib/auth.ts

@@ -146,6 +146,14 @@ export function redirectToPortalLogin(returnTo?: string): boolean {
   return true
 }
 
+/** End portal SSO session (refresh cookie + portal token). Do not pass return_to. */
+export function redirectToPortalLogout(): void {
+  clearToken()
+  resetPortalHandoff()
+  const url = `${authPortalUrl()}/logout`
+  window.location.assign(url)
+}
+
 export function parseHashToken(hash: string): {
   accessToken: string | null
   expiresAt: string | null

apps/web/src/routes/_auth/settings/appearance.tsx

@@ -7,7 +7,7 @@ import { api } from '@/lib/api-client'
 import {
   clearToken,
   isAuthEnabled,
-  redirectToPortalLogin,
+  redirectToPortalLogout,
   resetPortalHandoff,
 } from '@/lib/auth'
 import { SettingRow } from '@/components/setting-row'
@@ -60,7 +60,7 @@ function AppearanceSettingsPage() {
     clearToken()
     resetPortalHandoff()
     if (isAuthEnabled()) {
-      redirectToPortalLogin()
+      redirectToPortalLogout()
       return
     }
     void navigate({ to: '/login' })