fix(auth): logout actually signs out — clear the HttpOnly session cookie

Logout wiped localStorage but never cleared the token cookie (HttpOnly —
only a server response can) and never called the logout API, leaving the
refresh token live for 30 days and every cookie-authenticated SSR page
accessible: the fake-signout bug. Reproduced on prod and dev; unrelated
to RLS (it sits behind authentication) and long-standing.

- /api/auth/logout now ALWAYS clears the session cookie (Set-Cookie
  empty + Max-Age=-1, HttpOnly/Path/SameSite mirroring login) — even a
  malformed body must sign the browser out; refresh-token revocation
  unchanged.
- The header logout button (and the rules-page copy) now POST to the
  API with the stored refresh token BEFORE clearing local state and
  redirecting — best effort: local cleanup never blocks on API failure.
- toast 401 handler fixed: it cleared 'refreshToken' but storage uses
  'refresh_token' — the real key.
- Regression test TestLogoutClearsSession: real login → logout →
  response deletes the cookie; logged-out refresh token can't mint
  access tokens; body-less logout still clears.

Also carries regenerated artifacts from the confirm-modal and
episode-list work (header_templ/podcast_detail_templ/style.css).

web/src/collection-rules.ts

@@ -366,8 +366,21 @@ function clearForm(): void {
   if (testResultsDiv) testResultsDiv.classList.add("hidden");
 }
 
-function logout(): void {
+// Rules-page sign-out: same contract as the header's — the API clears
+// the HttpOnly session cookie and revokes the refresh token; local
+// cleanup and redirect are best-effort.
+async function logout(): Promise<void> {
+  try {
+    await fetch("/api/auth/logout", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ refresh_token: localStorage.getItem("refresh_token") ?? "" }),
+    });
+  } catch {
+    // redirect regardless
+  }
   localStorage.removeItem("token");
+  localStorage.removeItem("refresh_token");
   window.location.href = "/login";
 }
 

web/src/header.ts

@@ -12,12 +12,27 @@ import {
   revealCurrentTheme,
   updateWoodPanelingIndicators,
 } from "./theme";
-import { getSelectedLibrary } from "./storage";
+import { getSelectedLibrary, getRefreshToken, removeRefreshToken } from "./storage";
 import { addListener, removeListener } from "./websocket";
 
-const logout = (): void => {
+// Real sign-out: the HttpOnly session cookie can only be cleared by a
+// server response, and the refresh token (30d) must be revoked —
+// localStorage-only "logout" left the cookie session alive for days
+// (the fake-signout bug). Best effort: local state clears and the
+// redirect happens even if the API call fails.
+const logout = async (): Promise<void> => {
+  try {
+    await fetch("/api/auth/logout", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ refresh_token: getRefreshToken() ?? "" }),
+    });
+  } catch {
+    // keep going: local cleanup + redirect must never be blocked
+  }
   localStorage.removeItem("token");
   localStorage.removeItem("user");
+  removeRefreshToken();
   window.location.href = "/";
 };
 

web/src/toast.ts

@@ -229,7 +229,7 @@ const setupFetchInterceptor = (): void => {
       if (response.status === 401) {
         // Clear invalid tokens from localStorage
         localStorage.removeItem("token");
-        localStorage.removeItem("refreshToken");
+        localStorage.removeItem("refresh_token");
         localStorage.removeItem("user");
 
         // Check if this was a page navigation (not API call)