Full OIDC logout with id_token_hint for provider session termination

Return the OIDC id_token in the callback response so the frontend can
store it and pass it as id_token_hint to the provider's end-session
endpoint on logout. This lets Authentik (or any OIDC provider) honor
the post_logout_redirect_uri and redirect back to the Cameleer login
page instead of showing the provider's own logout page.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ui/src/api/openapi.json

@@ -1602,6 +1602,10 @@
           },
           "displayName": {
             "type": "string"
+          },
+          "idToken": {
+            "type": "string",
+            "description": "OIDC id_token for end-session logout (only present after OIDC login)"
           }
         },
         "required": [