fix(auth): revoke JWT on logout and harden Google sign-in

Logout now increments sessionVersion so existing JWTs are rejected
server-side, deletes orphaned DB sessions, and uses redirectTo for signOut.
Google OAuth requests account selection each time; optional AUTH_GOOGLE_PROMPT=login
forces Google re-authentication on shared devices.

Co-authored-by: Cursor <cursoragent@cursor.com>

memento-note/lib/auth-client.ts

@@ -0,0 +1,8 @@
+'use client';
+
+import { signOut } from 'next-auth/react';
+
+/** Ends the Momento session server-side (JWT revoked) and redirects to login. */
+export async function performSignOut(callbackUrl = '/login') {
+  await signOut({ redirectTo: callbackUrl });
+}

memento-note/lib/auth-providers.ts

@@ -9,11 +9,19 @@ export function buildAuthProviders() {
   const providers = [];
 
   if (process.env.AUTH_GOOGLE_ID && process.env.AUTH_GOOGLE_SECRET) {
+    const googlePrompt =
+      process.env.AUTH_GOOGLE_PROMPT === 'login' ? 'login' : 'select_account';
+
     providers.push(
       Google({
         clientId: process.env.AUTH_GOOGLE_ID,
         clientSecret: process.env.AUTH_GOOGLE_SECRET,
-        allowDangerousEmailAccountLinking: true,
+        authorization: {
+          params: {
+            prompt: googlePrompt,
+            access_type: 'online',
+          },
+        },
       }),
     );
   }