Sign out through the proxy when the proxy signed you in

Sign out cleared ipx's cookies and showed its password page, while
Cloudflare Access still vouched for the person: nothing was signed out,
and the page looked like the wrong login. /api/me now says, for someone
the proxy signed in, where to go instead ([web] sign_out_url, which is
/cdn-cgi/access/logout behind Access), and /login sends anyone the proxy
vouches for on to their feeds. The header check both use is one function.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TAC7sLVqfKmY6rsTLXzNgk

CHANGELOG.md

@@ -28,6 +28,9 @@ The long form, with what was wrong before and how it was found, is in
 
 - Show notes that the podcast's host cut off in the middle of a tag no longer open with a scrap of
   HTML: the item's other copy of its notes is shown instead. Daily Meditation Podcast had 57.
+- Signing out after signing in through Cloudflare Access no longer lands on ipodderx's own password
+  page. With the new `sign_out_url` set, Sign out ends the Access session, and the password page
+  sends anyone the proxy signs in straight to their feeds.
 - The sign-in guide, `docs/sso.md`, describes the setup ipodderx.sdf1.net really runs: Authentik as
   Cloudflare Access's identity provider, and how to find the address ipx has to trust. It had never
   been checked against a real setup, and pointed at the wrong address.