fix(web): logout redirects to /welcome, not /auth/login

Logout was bouncing the just-logged-out visitor straight back into a Dex
login. Land them on the public /welcome page instead — an intentional UX
fix. Cookie clearing and server-side session deletion are unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/web/oidc/oidc.go

@@ -266,7 +266,9 @@ func (d *DexAuth) handleLogout(w http.ResponseWriter, r *http.Request) {
 		d.sessions.delete(sid)
 	}
 	d.clearSessionCookie(w)
-	http.Redirect(w, r, loginPath, http.StatusFound)
+	// Land on the public landing page, not the login endpoint: a just-logged-out
+	// visitor should see /welcome, not be bounced straight back into a Dex login.
+	http.Redirect(w, r, "/welcome", http.StatusFound)
 }
 
 // redirectUnauthenticated sends an unauthenticated visitor somewhere useful: the