Logout deletes the ID token before building the Keycloak logout URL (WEB-005) #267

Moved from REVIEW-ISSUES.md (WEB-005), found in the review of uat at a828e1e on 2026-11-07.

Files: src/components/ProfileButton.tsx:101, src/utils/keycloak.ts:26

Problem. handleLogout removes kc_id_token from sessionStorage, then calls getPostLogoutUrl(), which reads it. Keycloak always receives an empty id_token_hint, so it may show a confirmation page or reject post_logout_redirect_uri. Separately, the button treats a kc_token in localStorage as logged in, but logout only clears sessionStorage.

Fix. Build the logout URL first, then clear tokens. Read and clear tokens from one storage only. Consider also sending client_id.

Related: #208 (ban appeal fixes) and #266 (WEB-031 (#266), ban-appeal login).

Same files as #268, #286 — Auth (keycloak.ts, ProfileButton.tsx, appeal.tsx). Take them together or one after another.