Nav-style flow: POST /auth/logout then reload the app — /me answers 401,
so the SPA shows its own sign-in gate (logo card with one button) instead
of bouncing to /auth/login, which silently re-authenticated through the
still-alive gnexus-auth session. OAuth now starts only from the explicit
"Sign in with GNEXUS" click; a non-401 failure on load keeps the old
redirect.

Co-Authored-By: Claude Code <noreply@anthropic.com>