fix(auth): revoke JWT on logout and harden Google sign-in

Logout now increments sessionVersion so existing JWTs are rejected
server-side, deletes orphaned DB sessions, and uses redirectTo for signOut.
Google OAuth requests account selection each time; optional AUTH_GOOGLE_PROMPT=login
forces Google re-authentication on shared devices.

Co-authored-by: Cursor <cursoragent@cursor.com>

memento-note/components/legal/delete-account-dialog.tsx

@@ -1,7 +1,7 @@
 'use client'
 
 import { useState } from 'react'
-import { signOut } from 'next-auth/react'
+import { performSignOut } from '@/lib/auth-client'
 import { Loader2, ShieldAlert } from 'lucide-react'
 import { toast } from 'sonner'
 import { useLanguage } from '@/lib/i18n'
@@ -42,7 +42,7 @@ export function DeleteAccountDialog({ userEmail, open, onOpenChange }: DeleteAcc
       }
 
       toast.success(t('account.deleteAccount.successRedirect'))
-      await signOut({ callbackUrl: '/login?deleted=true' })
+      await performSignOut('/login?deleted=true')
     } catch {
       toast.error(t('account.deleteAccount.errorFailed'))
       setIsDeleting(false)