Add central login recovery and confirmed shared sign-out

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c

docs/operations.md

@@ -164,3 +164,24 @@ not to a session running against production on its own.
 No resource-efficiency or throughput bounds are asserted here. Nothing in this
 repository benchmarks KeyCape, so any figure would be invention. Measure it in
 your own deployment before sizing against it.
+
+## Account recovery and browser sign-out
+
+Set `KEYCAPE_ACCOUNT_PORTAL_URL=https://users.coulomb.social` and
+`KEYCAPE_BROWSER_LOGOUT_URL=https://auth.coulomb.social/logout` together to enable
+central browser recovery. Both must be HTTPS, with no credentials, query or
+fragment. They override the corresponding YAML accountPortalURL/browserLogoutURL.
+Failed browser authorization and expired callbacks redirect to the fixed
+`/access-recovery` page with no state, code, claimed user or browser return URL.
+API authorization/token validation remains fail-closed.
+
+`GET /account/logout` displays confirmation and creates a short-lived Secure,
+HttpOnly host-only CSRF cookie. POST checks that cookie, the form nonce and exact
+issuer Origin; only then does it invalidate the current KeyCape session and
+redirect to Authelia's browser `/logout`, with a fixed portal `/logged-out` return.
+Authelia owns and deletes its session cookie. Its v4.38 SignOut view validates the
+return destination and performs the same-origin logout API call. Reference:
+https://github.com/authelia/authelia/blob/v4.38.19/web/src/views/LoginPortal/SignOut/SignOut.tsx
+Existing RP sessions and issued JWTs are not revoked. The original `/logout`
+endpoint retains its local-only contract. Actual shared-session destruction
+requires browser execution; a redirect-only smoke is not acceptance evidence.