fix(auth): revoke JWT on logout and harden Google sign-in

Logout now increments sessionVersion so existing JWTs are rejected
server-side, deletes orphaned DB sessions, and uses redirectTo for signOut.
Google OAuth requests account selection each time; optional AUTH_GOOGLE_PROMPT=login
forces Google re-authentication on shared devices.

Co-authored-by: Cursor <cursoragent@cursor.com>

memento-note/components/admin-sidebar.tsx

@@ -1,7 +1,8 @@
 'use client'
 
 import { usePathname } from 'next/navigation'
-import { signOut, useSession } from 'next-auth/react'
+import { useSession } from 'next-auth/react'
+import { performSignOut } from '@/lib/auth-client'
 import {
   LayoutDashboard,
   Users,
@@ -113,7 +114,7 @@ export function AdminSidebar({ className }: { className?: string }) {
               <DropdownMenuSeparator />
               <DropdownMenuItem
                 className="cursor-pointer text-destructive focus:text-destructive"
-                onClick={() => signOut({ callbackUrl: '/login' })}
+                onClick={() => performSignOut('/login')}
               >
                 <LogOut className="mr-2 h-4 w-4" />
                 {t('auth.signOut')}