feat(client): add endSession() for RP-initiated logout

[markwylde]

Summary

Closes the gap reported in #168. The server already ships an end_session_endpoint (GET /api/logout, advertised in /.well-known/openid-configuration) from #160 / #161, but @darkauth/client only had a local-only logout(). Apps that called it cleared their own tokens while the DarkAuth SSO session stayed alive, so the next initiateLogin() could silently re-authenticate (a problem on shared/kiosk devices).

This PR adds endSession() to the client so RPs can actually trigger RP-initiated logout.

Changes

• endSession(options?) — clears the local session (same as logout()), then redirects the browser to the end_session_endpoint with id_token_hint, post_logout_redirect_uri, client_id, and state.
  • id_token_hint defaults to the current session's ID token (overridable).
  • client_id is sent whenever post_logout_redirect_uri is provided (defaults to the configured clientId), matching the server's requirement that the redirect URI resolve to a client.
• Endpoint resolution — end_session_endpoint is read from discovery, with a new endSessionEndpoint config override and an <issuer>/api/logout fallback. Cached alongside the other resolved endpoints.
• logout() is unchanged (still local-only) for backwards compatibility.
• Types — new EndSessionOptions; added endSessionEndpoint? to Config.

Tests

Added src/endSession.test.ts (Node test runner) covering: discovery endpoint usage + param construction + local-session clearing, discovery fallback, config override, omission of client_id/post_logout_redirect_uri when no redirect URI is given, explicit clientId override, and that logout() does not redirect.

Tests run against the compiled output via a dedicated tsconfig.test.json → .test-build (gitignored) so no test files land in the published dist.

pnpm --filter @darkauth/client test       # passing
pnpm --filter @darkauth/client typecheck  # passing
pnpm --filter @darkauth/client build      # passing
pnpm --filter @darkauth/client check      # passing

Docs

• packages/darkauth-client/README.md: documented endSession(), EndSessionOptions, the endSessionEndpoint config field, and clarified that logout() is local-only.
• docs/rp-initiated-logout.md: added an "SDK Integration" section.

Note for RPs

post_logout_redirect_uri must be registered (exact match) in the client's Post-Logout Redirect URIs allowlist on the DarkAuth server, or the endpoint returns 400.