Consolidate auth routes under /auth and rename /u to /user

Moves the login screen from /login to /auth, logout from /logout to
/auth/logout (alongside the existing /auth/login and /auth/callback
endpoints), and the public profile route from /u/[id] to /user/[id].

AUTH_REDIRECT_URI and AUTH_POST_LOGOUT_URI already point at
/auth/callback and / respectively, so no Zitadel config change is
needed for the auth move.

web-player/src/routes/auth/logout/+server.ts

@@ -0,0 +1,21 @@
+import { redirect } from '@sveltejs/kit';
+import * as client from 'openid-client';
+import type { RequestHandler } from './$types';
+import { getOidcConfig, decodeSession, SESSION_COOKIE } from '$lib/server/auth';
+import { authConfig } from '$lib/server/config';
+
+const handleLogout: RequestHandler = async ({ cookies }) => {
+	const session = await decodeSession(cookies.get(SESSION_COOKIE));
+	cookies.delete(SESSION_COOKIE, { path: '/' });
+
+	const config = await getOidcConfig();
+	const endSessionUrl = client.buildEndSessionUrl(config, {
+		post_logout_redirect_uri: authConfig.postLogoutUri,
+		...(session?.idToken ? { id_token_hint: session.idToken } : {})
+	});
+
+	redirect(302, endSessionUrl.href);
+};
+
+export const GET = handleLogout;
+export const POST = handleLogout;