fix(auth): Riverpod lifecycle error + Authentik logout

- Fix "Cannot use Ref after disposed" error in OIDC callback page
  - Store notifier reference before async gap
  - Add mounted check at start of processing
- Add proper SSO logout via Authentik end_session_endpoint
  - Clears local tokens AND redirects to Authentik logout
  - Returns to app after Authentik session ends

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

lib/routing/app_router.dart

@@ -132,6 +132,9 @@ class _OidcCallbackPageState extends ConsumerState<_OidcCallbackPage> {
   }
 
   Future<void> _processCallback() async {
+    // Check mounted before any async work
+    if (!mounted) return;
+
     // Check for error from Authentik
     if (widget.error != null) {
       setState(() {
@@ -150,12 +153,15 @@ class _OidcCallbackPageState extends ConsumerState<_OidcCallbackPage> {
       return;
     }
 
+    // Get notifier reference before async gap to avoid disposed ref errors
+    final authNotifier = ref.read(authProvider.notifier);
+
     // Exchange code for tokens
     try {
-      await ref.read(authProvider.notifier).handleOidcCallback(
-            widget.code!,
-            widget.callbackState!,
-          );
+      await authNotifier.handleOidcCallback(
+        widget.code!,
+        widget.callbackState!,
+      );
 
       // Navigate to home on success
       if (mounted) {