fix(auth): revoke JWT on logout and harden Google sign-in

Logout now increments sessionVersion so existing JWTs are rejected
server-side, deletes orphaned DB sessions, and uses redirectTo for signOut.
Google OAuth requests account selection each time; optional AUTH_GOOGLE_PROMPT=login
forces Google re-authentication on shared devices.

Co-authored-by: Cursor <cursoragent@cursor.com>

memento-note/app/(auth)/login/page.tsx

@@ -2,14 +2,20 @@ import { LoginForm } from '@/components/login-form';
 import { getSystemConfig } from '@/lib/config';
 import { isGoogleAuthEnabled } from '@/lib/auth-providers';
 
-export default async function LoginPage() {
+export default async function LoginPage({
+  searchParams,
+}: {
+  searchParams: Promise<{ error?: string }>;
+}) {
   const config = await getSystemConfig();
   const allowRegister = config.ALLOW_REGISTRATION !== 'false' && process.env.ALLOW_REGISTRATION !== 'false';
+  const { error: authError } = await searchParams;
 
   return (
     <LoginForm
       allowRegister={allowRegister}
       googleAuthEnabled={isGoogleAuthEnabled()}
+      authError={authError}
     />
   );
 }