docs(auth): record fase-8 logout + migration 014 hardening

- CLAUDE.md status line + logout paragraph + migration 013 gotcha updated
  to cover the INSERT+UPDATE two-step GoTrue behaviour and the RP-initiated
  logout flow; new SvelteKit gotcha block spelling out the signOut→$effect
  race that produced "PKCE code verifier not found in storage" and how the
  isLoggingOut flag + /logged-out public route close it.
- docs/history/fase-8-auth-logout.md captures both prod bugs with symptom,
  root cause, fix, the Keycloak id_token_hint tradeoff (why the one-click
  confirmation page is accepted UX), and the test deltas.
- docs/development.md auth.ts one-liner updated.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs/development.md

@@ -18,7 +18,7 @@
 ```
 apps/web/src/lib/
   supabase.ts          # Supabase singleton client (PKCE, GoTrue auth)
-  auth.ts              # login() / logout() via supabase.auth.signInWithOAuth (Keycloak provider)
+  auth.ts              # login() via signInWithOAuth; logout() = signOut + RP-initiated Keycloak end-session → /logged-out
   stores/              # Svelte global stores
   sync/                # offline queue + conflict resolution
   components/          # reusable UI components