fix(auth): resolve OIDC logout URL before clearing auth state

[PKizzle]

Description

logoutWithOidcRedirect() called logout() before awaiting the config load, then set window.location.href to the RP-logout endpoint. Clearing auth state flips isAuthenticated to false, so during the await import() / loadConfig() gap DashboardAuthGuard fires router.replace("/auth/login/?unauthorized=true"). That redirect preempts the not-yet-assigned window.location.href, so the browser never reaches /rustfs/admin/v3/oidc/logout, the one-time logout token is never consumed, and the IdP session is left active.

This resolves the logout URL first and only then clears state and navigates, in the same synchronous step, so nothing can await between the state change and the redirect. Behaviour is otherwise unchanged: local state is still always cleared, and the no-session / error paths still return false.

Type of Change

• Bug fix (non-breaking change which fixes an issue)

Testing

• Unit tests added/updated
• Manual testing completed

Added tests/lib/oidc-logout-source.test.js to lock the ordering (destination built before logout(); state not cleared ahead of the config await). Reproduced the original race and verified the fix against Authentik as the IdP: logout now reaches /rustfs/admin/v3/oidc/logout, which redirects to the provider end_session_endpoint and terminates the session.

pnpm test:run

Checklist

• Code follows the project's style guidelines
• Self-review completed
• TypeScript types are properly defined
• All commit messages are in English (Conventional Commits)
• All existing tests pass
• No new dependencies added, or they are justified

Related Issues

Closes #190