fix: Logout löscht auch OIDC-Flow-Cookies (state, nonce, verifier)

app/api/auth/logout/route.ts

@@ -1,14 +1,25 @@
 import { NextResponse } from "next/server";
 import { SESSION_COOKIE } from "../../../../lib/auth";
+import { STATE_COOKIE, NONCE_COOKIE, VERIFIER_COOKIE } from "../../../../lib/oidc";
+
+const OIDC_FLOW_COOKIES = [STATE_COOKIE, NONCE_COOKIE, VERIFIER_COOKIE] as const;
+
+/** Löscht App-Session plus abgebrochene OIDC-Flows (state, nonce, PKCE-verifier). */
+function clearAuthCookies(res: NextResponse) {
+  res.cookies.set(SESSION_COOKIE, "", { path: "/", maxAge: 0 });
+  for (const name of OIDC_FLOW_COOKIES) {
+    res.cookies.set(name, "", { path: "/", maxAge: 0 });
+  }
+}
 
 export async function POST() {
   const res = NextResponse.json({ ok: true });
-  res.cookies.set(SESSION_COOKIE, "", { path: "/", maxAge: 0 });
+  clearAuthCookies(res);
   return res;
 }
 
 export async function GET(req: Request) {
   const res = NextResponse.redirect(new URL("/login", req.url));
-  res.cookies.set(SESSION_COOKIE, "", { path: "/", maxAge: 0 });
+  clearAuthCookies(res);
   return res;
 }