Add central login recovery and confirmed shared sign-out

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c

src/internal/config/validate.go

@@ -12,6 +12,18 @@ import (
 // Called at startup — the server must exit 1 if any errors are returned.
 func ValidateConfig(cfg *Config) []string {
 	var errs []string
+	for name, raw := range map[string]string{"accountPortalURL": cfg.AccountPortalURL, "browserLogoutURL": cfg.BrowserLogoutURL} {
+		if raw == "" {
+			continue
+		}
+		u, err := url.Parse(raw)
+		if err != nil || u.Scheme != "https" || u.Hostname() == "" || u.User != nil || u.RawQuery != "" || u.Fragment != "" {
+			errs = append(errs, name+": must be an HTTPS URL without credentials, query or fragment")
+		}
+	}
+	if (cfg.AccountPortalURL == "") != (cfg.BrowserLogoutURL == "") {
+		errs = append(errs, "accountPortalURL and browserLogoutURL must be configured together")
+	}
 
 	// Issuer must be a valid URL with an http(s) scheme.
 	if cfg.Issuer == "" {