fix(auth): revoke JWT on logout and harden Google sign-in

Logout now increments sessionVersion so existing JWTs are rejected
server-side, deletes orphaned DB sessions, and uses redirectTo for signOut.
Google OAuth requests account selection each time; optional AUTH_GOOGLE_PROMPT=login
forces Google re-authentication on shared devices.

Co-authored-by: Cursor <cursoragent@cursor.com>

memento-note/prisma/schema.prisma

@@ -15,6 +15,7 @@ model User {
   emailVerified         DateTime?
   password              String?
   role                  String                  @default("USER")
+  sessionVersion        Int                     @default(0)
   image                 String?
   theme                 String                  @default("light")
   resetToken            String?                 @unique