feat(auth): pass id_token_hint on Keycloak logout

Carries the raw ID token in the session cookie so logout can hand it back
to Keycloak as id_token_hint, letting it skip its own logout-confirmation
prompt -- otherwise a user could cancel out of it and land back in the app
with a Keycloak SSO session but no geniusrun profile (e.g. right after
deleting their account).

backend/internal/auth/oidc.go

@@ -6,6 +6,7 @@ import (
 	"encoding/base64"
 	"fmt"
 	"net/url"
+	"slices"
 
 	"github.com/coreos/go-oidc/v3/oidc"
 	"golang.org/x/oauth2"
@@ -24,7 +25,11 @@ type Verifier interface {
 	HandleCallback(ctx context.Context, txn TxnState, query url.Values) (LoginResult, error)
 	// EndSessionURL builds the identity provider's logout URL, redirecting
 	// back to postLogoutRedirectURL once Keycloak's own session is cleared.
-	EndSessionURL(postLogoutRedirectURL string) string
+	// idTokenHint, if non-empty, is passed as id_token_hint so Keycloak can
+	// positively identify the session being ended and skip its own
+	// logout-confirmation prompt (which would otherwise let the user cancel
+	// out of logout after their geniusrun account is already deleted).
+	EndSessionURL(postLogoutRedirectURL, idTokenHint string) string
 }
 
 // LoginResult is what a completed callback exchange resolves to.
@@ -55,12 +60,7 @@ type idTokenClaims struct {
 }
 
 func (c idTokenClaims) hasRole(required string) bool {
-	for _, r := range c.RealmAccess.Roles {
-		if r == required {
-			return true
-		}
-	}
-	return false
+	return slices.Contains(c.RealmAccess.Roles, required)
 }
 
 type oidcVerifier struct {
@@ -135,12 +135,12 @@ func (v *oidcVerifier) HandleCallback(ctx context.Context, txn TxnState, query u
 		return LoginResult{}, fmt.Errorf("decode id_token claims: %w", err)
 	}
 	return LoginResult{
-		Claims:     Claims{Sub: claims.Sub, Name: claims.Name, Email: claims.Email},
+		Claims:     Claims{Sub: claims.Sub, Name: claims.Name, Email: claims.Email, IDToken: rawIDToken},
 		Authorized: claims.hasRole(v.requiredRole),
 	}, nil
 }
 
-func (v *oidcVerifier) EndSessionURL(postLogoutRedirectURL string) string {
+func (v *oidcVerifier) EndSessionURL(postLogoutRedirectURL, idTokenHint string) string {
 	var discovery struct {
 		EndSessionEndpoint string `json:"end_session_endpoint"`
 	}
@@ -154,6 +154,9 @@ func (v *oidcVerifier) EndSessionURL(postLogoutRedirectURL string) string {
 	q := u.Query()
 	q.Set("client_id", v.oauth2Config.ClientID)
 	q.Set("post_logout_redirect_uri", postLogoutRedirectURL)
+	if idTokenHint != "" {
+		q.Set("id_token_hint", idTokenHint)
+	}
 	u.RawQuery = q.Encode()
 	return u.String()
 }