fix(auth): revoke JWT on logout and harden Google sign-in

Logout now increments sessionVersion so existing JWTs are rejected
server-side, deletes orphaned DB sessions, and uses redirectTo for signOut.
Google OAuth requests account selection each time; optional AUTH_GOOGLE_PROMPT=login
forces Google re-authentication on shared devices.

Co-authored-by: Cursor <cursoragent@cursor.com>

memento-note/lib/auth-client.ts

@@ -0,0 +1,8 @@
+'use client';
+
+import { signOut } from 'next-auth/react';
+
+/** Ends the Momento session server-side (JWT revoked) and redirects to login. */
+export async function performSignOut(callbackUrl = '/login') {
+  await signOut({ redirectTo: callbackUrl });
+}