feat: expose OIDC end-session endpoint - #1102

OAuth-backed sessions currently only log out of Tinyauth. When the
upstream provider keeps its SSO session, the next protected application
access can immediately create a new Tinyauth session, so logout does not
behave like an end-to-end sign-out for OIDC providers that support
RP-initiated logout.

Add an optional OAuth provider logoutUrl for the OpenID Provider
end_session_endpoint and keep the provider id_token server-side on the
Tinyauth session. The logout handler now deletes the local session,
builds the OP logout request with client_id, id_token_hint,
post_logout_redirect_uri, and state, and returns that redirect to the
frontend. The callback endpoint validates and restores the requested
application return URL after the OP hop.

Persist oauth_id_token for SQLite, Postgres, memory, SQLC generated
repositories, and store wrapper models so refreshed sessions retain the
token. Add migrations for both database drivers. Update the logout page
and quick actions menu to follow backend-provided redirect URLs while
keeping Tinyauth redirect_uri separate from OIDC
post_logout_redirect_uri.

Cover the new behavior with controller tests for safe logout redirects,
logout URL construction, and use of the server-side id_token. Enable TLS
on the dev whoami route so the local Traefik setup exercises the
secure-cookie and OIDC logout flow.

Co-Authored-By: OpenAI Codex <codex@openai.com>