Sign out through the proxy when the proxy signed you in

Sign out cleared ipx's cookies and showed its password page, while
Cloudflare Access still vouched for the person: nothing was signed out,
and the page looked like the wrong login. /api/me now says, for someone
the proxy signed in, where to go instead ([web] sign_out_url, which is
/cdn-cgi/access/logout behind Access), and /login sends anyone the proxy
vouches for on to their feeds. The header check both use is one function.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TAC7sLVqfKmY6rsTLXzNgk

docs/history.md

@@ -47,6 +47,14 @@ Every change, in order, with how to undo it:
    iPodderX icon, and a link to `https://ipodderx.sdf1.net`. It changes nothing about who can sign
    in. Undo: delete it under Applications → Applications, or
    `DELETE /api/v3/core/applications/ipodderx/`.
+6. **Signing out**, later again. Sign out landed on ipx's password page while Access still vouched
+   for Ray, so it signed nothing out, and the page looked like the wrong login. Cloudflare's
+   `/cdn-cgi/access/logout` ends the Access session for every Access application at once (there is
+   no per-application sign-out, and it takes no redirect), and Authentik's end-session only ends
+   one application's session unless single logout is set up there. Ray chose Access's sign-out. New
+   `[web] sign_out_url`, set to `/cdn-cgi/access/logout` in production (the file as it was is
+   `config.toml.2026-09-12-signout.bak`), and `/login` now sends anyone the proxy vouches for on to
+   `/`. Undo: take the key out and restart; the code does nothing without it.
 
 What the address trusts is any container on Tower that connects through the host's port, not only
 `cloudflared`. Verifying Cloudflare's signed `Cf-Access-Jwt-Assertion` would remove that, and is