Logout (todo §4); GET /logout clears plainpages_jwt + revokes the Kratos session (createLogoutFlow → redirect to Kratos logout URL → /login); wire shell Sign out link

src/login.test.ts

@@ -31,6 +31,7 @@ const adminStub = (over: Partial<KratosAdmin> = {}): KratosAdmin => ({
 });
 
 const publicStub = (over: Partial<KratosPublic> = {}): KratosPublic => ({
+  createLogoutFlow: async () => null,
   getFlow: async () => { throw new Error("unused"); },
   initBrowserFlow: async () => { throw new Error("unused"); },
   submitFlow: async () => { throw new Error("unused"); },