fix backchannel 5

fix 502 on logout: use client_id instead of id_token_hint

The id_token JWT in the Location header query string made the header too
large for nginx proxy_buffer_size, causing 502. Replace id_token_hint
with the short client_id parameter — Keycloak identifies the session
from its own cookie, client_id is enough to validate post_logout_redirect_uri.

Removes id_token storage in session (no longer needed).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>