Release v2.9.0

Logging out only cleared the local AuthProxy session, leaving the user signed in at the identity provider so the next visit silently re-authenticated. /.cratis/logout now performs a full-chain logout that also ends the session at the provider.

Added

• /.cratis/logout now performs OIDC RP-initiated logout: for a session established through an OIDC provider it redirects the browser to the provider's end_session_endpoint with id_token_hint and a post_logout_redirect_uri pointing at the new /.cratis/logout/callback, which then clears every AuthProxy cookie and redirects to the validated final target.
• Cratis:AuthProxy:... OIDC applications should register https://<proxy-host>/.cratis/logout/callback as a permitted post-logout redirect URI.

Changed

• The final redirect target is now validated against the post-logout allow-list on both legs of the round-trip (initiation and callback), and is carried across the identity-provider round-trip in a short-lived HTTP-only cookie rather than in the URL.
• OAuth 2.0 providers (such as GitHub) have no standard OIDC end-session endpoint and cannot be force-logged-out via a redirect; those sessions — and any request with no active OIDC session — fall back to the previous local-only logout (clear cookies + redirect). See Documentation/configuration/logout.md.