[g105b]

Logout cleared persisted authentication but left the current authenticator logged in when a custom redirect handler ran. A return URI configured with setReturnUri() was sent only as u, so the provider did not use it as the logout destination.

Clear both the stored authentication and in-memory user/session data before redirecting. Send the configured return URI in the encrypted redirectTo field already supported by the provider. An explicit logout($redirectTo) takes priority; without either setting, retain the provider's default destination. Keep unrelated session data and the default fake user's local-only logout behaviour. Document destination precedence in the README and remove the obsolete logout TODO.

The return override is now optional internally, preserving the existing current-request fallback for login and profile URI generation while distinguishing an explicitly configured logout return destination.

Closes #19.

Validation

• e76a2a2 commits two regression tests first, verified failing on master: stale identity at redirect time and missing encrypted destination.
• ebe7c96 implements the fix and expands destination coverage (configured return, explicit path/URI/query override, provider default).
• composer test: 63 tests, 147 assertions; PHPStan level 6, PHP_CodeSniffer and PHPMD pass locally on PHP 8.5.
• Tests decrypt real outgoing logout ciphers, verify the deployment ID/action/destination, confirm logout state before redirect, and restore a fresh logged-out authenticator using the same session.
• Compared the protocol against the provider's current master and admin-interface--new-flair logout handlers: both already accept encrypted redirectTo, so no provider change or branch merge is needed.

No live browser/provider deployment test was performed; the regression checks cover client state, encryption and the outgoing provider contract. GitHub CI checks PHP 8.4 and PHP 8.5.