fix: make OIDC logout resilient to end-session endpoint failures

Fire end-session via fetch(no-cors) instead of window.location redirect.
Always navigate to /login?local regardless of whether end-session
succeeds, preventing broken JSON responses from blocking logout.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ui/src/auth/auth-store.ts

@@ -154,15 +154,17 @@ export const useAuthStore = create<AuthState>((set, get) => ({
       isAuthenticated: false,
       error: null,
     });
+    const loginUrl = `${config.basePath}login?local`;
     if (endSessionEndpoint && idToken) {
-      const postLogoutRedirect = `${window.location.origin}${config.basePath}login?local`;
       const params = new URLSearchParams({
         id_token_hint: idToken,
-        post_logout_redirect_uri: postLogoutRedirect,
+        post_logout_redirect_uri: `${window.location.origin}${config.basePath}login?local`,
+      });
+      fetch(`${endSessionEndpoint}?${params}`, { mode: 'no-cors' }).finally(() => {
+        window.location.href = loginUrl;
       });
-      window.location.href = `${endSessionEndpoint}?${params}`;
     } else {
-      window.location.href = `${config.basePath}login?local`;
+      window.location.href = loginUrl;
     }
   },
 }));