fix(web): logout redirects to /welcome, not /auth/login

Logout was bouncing the just-logged-out visitor straight back into a Dex
login. Land them on the public /welcome page instead — an intentional UX
fix. Cookie clearing and server-side session deletion are unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/web/oidc/oidc.go

@@ -266,7 +266,9 @@ func (d *DexAuth) handleLogout(w http.ResponseWriter, r *http.Request) {
 		d.sessions.delete(sid)
 	}
 	d.clearSessionCookie(w)
-	http.Redirect(w, r, loginPath, http.StatusFound)
+	// Land on the public landing page, not the login endpoint: a just-logged-out
+	// visitor should see /welcome, not be bounced straight back into a Dex login.
+	http.Redirect(w, r, "/welcome", http.StatusFound)
 }
 
 // redirectUnauthenticated sends an unauthenticated visitor somewhere useful: the

internal/web/oidc/oidc_test.go

@@ -304,6 +304,7 @@ func TestLogoutClearsSession(t *testing.T) {
 	auth.Routes().ServeHTTP(rec, req)
 
 	require.Equal(t, http.StatusFound, rec.Code)
+	require.Equal(t, "/welcome", rec.Header().Get("Location"), "logout lands on the public page")
 	cleared := sessionCookie(t, rec.Result())
 	require.Less(t, cleared.MaxAge, 0, "logout expires the cookie")