fix(cli): prompt for fresh OIDC login after logout

[grs]

Summary

Fix OIDC logout/login behavior so openshell gateway logout causes the next browser-based openshell gateway login to request a fresh identity-provider prompt. This lets users switch browser identities instead of silently reusing the previous SSO session.

Related Issue

Changes

• Added a per-gateway one-shot marker requesting prompt=login after OIDC logout.
• Cleared the marker after a successful token store or gateway registration removal.
• Updated the browser OIDC auth flow to append prompt=login when the marker is present.
• Updated CLI help text and gateway auth docs to describe the fresh-login behavior.
• Added unit coverage for marker lifecycle and authorization URL parameters.

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)
• Manual testing

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[sjenning]

Code review found no issues.

I tested locally and it does work:

openshell gateway login (prompt page on OIDC provider)
openshell gateway login (skips prompt on OIDC provider and reauthenticates automatically)
openshell gateway logout
openshell gateway login (prompt page on OIDC provider)

[sjenning]

/ok to test 5bce638