Full OIDC logout with id_token_hint for provider session termination

Return the OIDC id_token in the callback response so the frontend can
store it and pass it as id_token_hint to the provider's end-session
endpoint on logout. This lets Authentik (or any OIDC provider) honor
the post_logout_redirect_uri and redirect back to the Cameleer login
page instead of showing the provider's own logout page.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

cameleer3-server-app/src/main/java/com/cameleer3/server/app/dto/AuthTokenResponse.java

@@ -7,5 +7,7 @@ import jakarta.validation.constraints.NotNull;
 public record AuthTokenResponse(
         @NotNull String accessToken,
         @NotNull String refreshToken,
-        @NotNull String displayName
+        @NotNull String displayName,
+        @Schema(description = "OIDC id_token for end-session logout (only present after OIDC login)")
+        String idToken
 ) {}