User still logged in after logout: app session vs Auth0 session vs federated

# Diagnose: logout does not stick

## Symptom

Logout appears to work, but the next login attempt skips credentials and returns as the same user.

## Likely causes

1. App cleared its own session but never hit `https://YOUR-TENANT-DOMAIN/v2/logout`. The Auth0 SSO cookie survives; the next authorize silently re-authenticates.
2. Hit /v2/logout but returnTo was not allowlisted, so Auth0 showed an error page and the user closed it mid-flow; the session may or may not have cleared.
3. Federated IdP session: the user logged in via Google/enterprise; Auth0 session cleared but the IdP session survives, so the next login round-trips the IdP silently. Needs `federated=true` on logout.
4. SDK logout called without logoutParams, so no redirect happened at all (SPA cleared local state only).

## Confirm

- DevTools network: after logout, is there a request to /v2/logout? If not, the app never logged out of Auth0.
- After logout, open the tenant domain in a tab: if the Auth0 session cookie is still present, /v2/logout did not complete.
- Tenant logs: logout events (type `slo` / `flo`) confirm server-side logout.

## Fix

Always do the full round trip: clear app state, redirect to /v2/logout with an allowlisted returnTo, and add federated=true when upstream IdP logout is wanted.

## Verify

In a fresh profile: login, logout, then navigate to a protected route and confirm the login page appears (not an instant redirect back in). Test the federated case separately if you use it.