feat(web): add registered user sign out

[rd-code-23]

What changed

• Added a “Sign out” action to the profile menu for Google-authenticated users.
• Connected that action to the existing CSRF-protected logout mutation.
• Preserved the existing “Exit guest” action for guest identities.
• Prevented guest mode from starting an unnecessary registered-user session query.
• Added focused profile-menu coverage for registered users.

How sign-out works

The protected application layout owns the logout mutation and passes a registered-user logout callback into the application shell. The profile menu chooses its action from the current identity:

• Guests receive “Exit guest,” which clears temporary guest state.
• Registered users receive “Sign out,” which calls POST /auth/logout.

The existing logout mutation obtains a CSRF token, invalidates the server-side session, and changes the authoritative current-user query cache to { user: null }. The application access boundary then observes the anonymous identity and redirects the browser to the welcome page.

This keeps session state in TanStack Query rather than duplicating it inside the profile component.

Guest access cleanup

Previously, ApplicationAccessBoundary called useCurrentUser() before checking guest mode. That meant a guest could enter the application immediately, but an unnecessary account-session request still ran in the background.

Guest detection now happens in the outer boundary. Only the registered-user access component mounts useCurrentUser(), so guest mode no longer creates an irrelevant authentication query.

Validation

• pnpm lint
• pnpm typecheck
• pnpm test — 106 tests passed across contracts, API, and web
• pnpm build
• Prettier check on all four changed files