fix: update logout flow to use registered post-logout route and add redirect handler

frontend/src/lib/server/workspace-auth.ts

@@ -147,10 +147,14 @@ export function redirectToKeycloakAuthorization(systemBaseUrl: string, redirectP
 
 export function buildKeycloakLogoutUrl(systemBaseUrl: string): string {
 	const keycloakBaseUrl = getPublicKeycloakBaseUrl();
-	const workspaceLoginUrl = getWorkspaceLoginUrl(systemBaseUrl, { forPostLogout: true });
+	// post_logout_redirect_uri must be a URI registered in the KC client.
+	// The workspace login URL (workspace.aduanasoft.com/login) is NOT registered there.
+	// Use a local /auth/post-logout route which IS covered by the app's registered wildcard,
+	// then that route bounces to workspace login.
+	const postLogoutRedirectUri = `${systemBaseUrl}/auth/post-logout`;
 	const params = new URLSearchParams({
 		client_id: getKeycloakClientId(),
-		post_logout_redirect_uri: workspaceLoginUrl
+		post_logout_redirect_uri: postLogoutRedirectUri
 	});
 
 	return `${keycloakBaseUrl}/realms/${getKeycloakRealm()}/protocol/openid-connect/logout?${params.toString()}`;