fix: logout redirect loop

Changed GET /auth/logout to redirect to rpFrontendUrl instead of /login
to prevent re-authentication loop. When user logged out, redirecting to
/login would immediately start new OIDC flow with still-valid SwissOID
session, causing auto-login.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

src/oidc/OIDCStandardRoutes.ts

@@ -674,10 +674,10 @@ export function createOidcStandardRoutes(config: OidcStandardConfig): Router {
 
       res.clearCookie(sessionCookieName, getCookieOptions());
 
-      // For GET requests, redirect to login page
+      // For GET requests, redirect to frontend landing page to avoid re-login loop
       // For POST requests, return JSON
       if (req.method === 'GET') {
-        return res.redirect('/login');
+        return res.redirect(rpFrontendUrl);
       } else {
         return res.json({ success: true });
       }
@@ -685,7 +685,7 @@ export function createOidcStandardRoutes(config: OidcStandardConfig): Router {
     } catch (error) {
       logger.error('Error during logout', error);
       if (req.method === 'GET') {
-        return res.redirect('/login');
+        return res.redirect(rpFrontendUrl);
       } else {
         return res.status(500).json({ error: 'Logout failed' });
       }