feat(ui): add sign out and stop the idle dialog offering re-authentication

[yashau]

Why

The idle dialog offered Reload and re-authenticate beside Carry on, which read as an identity check you were allowed to wave off. It wasn't one. The watcher wipes every revealed value before raising its flag, so by the time the dialog mounts the values are already gone and neither button can bring them back. Access owns the identity check, its session is measured in hours, and the app had no sign out to pair a sign-in with — so the reload was theatre.

What changed

The dialog is now a notice with one Continue. Copy drops the "confirm you are still you" framing; the only cost of continuing is revealing again, and it now says so.

Dismissal moves to onOpenChange, replacing the escapeKeydownBehavior/interactOutsideBehavior "ignore" pair. open is driven by the store, so a close Bits performed on its own left the flag set and the dialog wedged — routing every close through resume() keeps the two in step, and a notice with nothing to decide should take Escape for an answer.

Signing out becomes a deliberate act, in the sidebar footer. The viewer button is now a dropdown (same idiom as project-switcher) carrying the address as a heading and a Sign out item pointing at Cloudflare's /cdn-cgi/access/logout.

Three things worth a reviewer's attention:

• data-sveltekit-reload is load-bearing. The path is same-origin, so the router would otherwise claim the click and look for a route that doesn't exist. The endpoint is served at the edge and never reaches the Worker, so it has to be a real document request.
• Logout is team-wide, not per-app. Cloudflare is explicit that there's no per-application logout; this revokes the session across every Access app in the team, and issued tokens keep working for another 20–30 seconds.
• Service tokens get a disabled item saying they hold no session, rather than a button that would do nothing — they authenticate per request with a client id and secret, so there's no cookie to clear.

Verification

• mise run lint:js, fmt:check:js, lint:typos, lint:loc — green
• svelte-check — 2158 files, 0 errors, 0 warnings
• App unit tests — 34 files, 1152 passed
• pre-push gate (typecheck, clippy, rust + js tests) — green

Not verified by me: that Entra lands on its account picker rather than a password prompt when several accounts are signed in. That's the motivating use case and it's asserted in a code comment, but confirming it needs a real sign-out against the live instance. There's also no documented returnTo on the logout endpoint, so you land on Cloudflare's own logout page rather than back here.

🤖 Generated with Claude Code