fix(auth): revoke JWT on logout and harden Google sign-in

Logout now increments sessionVersion so existing JWTs are rejected
server-side, deletes orphaned DB sessions, and uses redirectTo for signOut.
Google OAuth requests account selection each time; optional AUTH_GOOGLE_PROMPT=login
forces Google re-authentication on shared devices.

Co-authored-by: Cursor <cursoragent@cursor.com>

memento-note/app/(main)/settings/profile/profile-form.tsx

@@ -4,7 +4,7 @@ import { useState } from 'react'
 import { Input } from '@/components/ui/input'
 import { updateProfile, changePassword } from '@/app/actions/profile'
 import { updateUserSettings } from '@/app/actions/user-settings'
-import { signOut } from 'next-auth/react'
+import { performSignOut } from '@/lib/auth-client'
 import { toast } from 'sonner'
 import { useLanguage } from '@/lib/i18n'
 import { User, Mail, Shield, LogOut, Camera, Bell } from 'lucide-react'
@@ -143,7 +143,7 @@ export function ProfileForm({ user }: { user: { name: string | null; email: stri
           {/* Logout */}
           <div className="pt-8 border-t border-border/40">
             <button
-              onClick={() => signOut({ callbackUrl: '/login' })}
+              onClick={() => performSignOut('/login')}
               className="flex items-center gap-3 px-6 py-3 bg-rose-50 dark:bg-rose-500/10 text-rose-600 rounded-xl font-bold uppercase tracking-widest text-[10px] hover:bg-rose-100 transition-colors"
             >
               <LogOut size={16} />