feat(auth): pass id_token_hint on Keycloak logout

Carries the raw ID token in the session cookie so logout can hand it back
to Keycloak as id_token_hint, letting it skip its own logout-confirmation
prompt -- otherwise a user could cancel out of it and land back in the app
with a Keycloak SSO session but no geniusrun profile (e.g. right after
deleting their account).

backend/internal/auth/session_test.go

@@ -8,7 +8,7 @@ import (
 const testSecret = "test-secret-at-least-32-bytes-long!"
 
 func TestMintAndParseSessionCookie(t *testing.T) {
-	claims := Claims{Sub: "u1", Name: "Alice", Email: "alice@example.com"}
+	claims := Claims{Sub: "u1", Name: "Alice", Email: "alice@example.com", IDToken: "raw-id-token-jwt"}
 	cookie, err := MintSessionCookie(claims, []byte(testSecret), time.Hour, true)
 	if err != nil {
 		t.Fatalf("mint: %v", err)