fix(auth): revoke JWT on logout and harden Google sign-in

Logout now increments sessionVersion so existing JWTs are rejected
server-side, deletes orphaned DB sessions, and uses redirectTo for signOut.
Google OAuth requests account selection each time; optional AUTH_GOOGLE_PROMPT=login
forces Google re-authentication on shared devices.

Co-authored-by: Cursor <cursoragent@cursor.com>

memento-note/auth.config.ts

@@ -9,6 +9,8 @@ export const authConfig = {
   trustHost: true,
   session: {
     strategy: 'jwt',
+    maxAge: 60 * 60 * 24 * 7,
+    updateAge: 60 * 60 * 12,
   },
   callbacks: {
     authorized({ auth, request: { nextUrl } }) {