Sign out

This local sign-out page replaces the old redirect-only route and makes the handoff explicit. SSO remains the session authority, but the user now sees a real page before leaving the shell.