Finish KEY-WP-0008: registration handoff and client MFA isolation

Add signed registration/enrollment handoffs, per-request assurance
policy with login-session isolation, and /logout. coulomb-social
stays AAL1 unless acr_values or another client raises the bar.

src/internal/server/oidc/discovery.go

@@ -16,6 +16,7 @@ type DiscoveryConfig struct {
 	TokenEndpoint         string
 	JWKSUri               string
 	UserinfoEndpoint      string // optional, empty = not advertised
+	EndSessionEndpoint    string // optional, empty = not advertised
 }
 
 // discoveryDocument is the JSON shape of /.well-known/openid-configuration.
@@ -27,6 +28,7 @@ type discoveryDocument struct {
 	TokenEndpoint                     string   `json:"token_endpoint"`
 	JWKSUri                           string   `json:"jwks_uri"`
 	UserinfoEndpoint                  string   `json:"userinfo_endpoint,omitempty"`
+	EndSessionEndpoint                string   `json:"end_session_endpoint,omitempty"`
 	ResponseTypesSupported            []string `json:"response_types_supported"`
 	GrantTypesSupported               []string `json:"grant_types_supported"`
 	CodeChallengeMethodsSupported     []string `json:"code_challenge_methods_supported"`
@@ -53,6 +55,7 @@ func NewDiscoveryHandler(cfg DiscoveryConfig) http.Handler {
 		TokenEndpoint:         cfg.TokenEndpoint,
 		JWKSUri:               cfg.JWKSUri,
 		UserinfoEndpoint:      cfg.UserinfoEndpoint,
+		EndSessionEndpoint:    cfg.EndSessionEndpoint,
 
 		// Profile-locked values — not negotiable.
 		ResponseTypesSupported:            []string{"code"},