Add central login recovery and confirmed shared sign-out

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c

src/cmd/keycape/main.go

@@ -162,14 +162,15 @@ func main() {
 	// Authorize handler (with enforcement middleware).
 	logins := oidc.NewLoginSessionStore()
 	authorizeHandler := &oidc.AuthorizeHandler{
-		ClientConfig: clients,
-		Auth:         autheliaAdapter,
-		MFA:          privacyIDEAAdapter,
-		Sessions:     sessions,
-		Logins:       logins,
-		Handoffs:     oidc.NewHandoffStore(),
-		Issuer:       issuer,
-		Emitter:      emitter,
+		AccountPortalURL: cfg.AccountPortalURL,
+		ClientConfig:     clients,
+		Auth:             autheliaAdapter,
+		MFA:              privacyIDEAAdapter,
+		Sessions:         sessions,
+		Logins:           logins,
+		Handoffs:         oidc.NewHandoffStore(),
+		Issuer:           issuer,
+		Emitter:          emitter,
 	}
 	mux.Handle("/authorize", enforcement.Middleware(authorizeHandler))
 	mux.Handle("/authorize/callback", authorizeHandler)
@@ -181,6 +182,13 @@ func main() {
 		SecureCookie: strings.HasPrefix(strings.ToLower(issuer), "https://"),
 	})
 
+	if cfg.AccountPortalURL != "" {
+		mux.Handle("/account/logout", &oidc.AccountLogoutHandler{
+			PortalURL: cfg.AccountPortalURL, UpstreamLogoutURL: cfg.BrowserLogoutURL,
+			Logins: logins, Issuer: issuer,
+		})
+	}
+
 	// Token handler (with enforcement middleware).
 	tokenHandler := &oidc.TokenHandler{
 		ClientConfig:  clients,