fix(auth): let the Lens signed-out page reach the central account

[jzhao234]

TLDR

Signing out of Lens ends only the Lens session; the central Auth session that signs users into every Elcano app keeps going, and the next click on Lens silently signs them back in. The signed-out page now links to the central account page, where that session can actually be ended. Explorer's signed-out page already does this; Lens's did not.

Problem

/signed-out rendered "Sign in again" and nothing else. In central mode a user who wanted to stop being signed in (shared machine, leaving for the day) had no path from Lens to Auth's /account page, which holds the only logout form for the central session. The comment on the route said the page was "provider-free", so nobody had wired the link.

Fix

• The route passes account_url to the template: the Auth issuer's /account in central mode, the configured login URL in Elcano mode (Elcano-mode logout never lands here, but the template must not render a broken link if it does).
• The template gains a secondary "Manage your central account" link under the sign-in button, matching Explorer's wording. The page stays public and reads no identity; it only reads deployment config.

Tests

• test_central_logout_stays_signed_out_until_the_user_chooses_to_sign_in now asserts the rendered page links to http://auth.example.com/account (fails before, passes after).
• ruff check, ruff format --check, and the full suite (333 passed, 1 skipped) are green.