Feature: security with session tracking, backchannel logout, and SSO

Feature description

Pocket ID is great, and I appreciate the simple approach to OIDC and auth. However, there are certain design decisions which make me hesitate to use with family/friends.

Right now, it seems like if you log out of one app, it doesn't log out of the others? Pocket ID doesnt' seem to describe itself as an SSO provider anywhere I can find, so this is at least consistent.

However, in general the expectation is that if login is unified, so is logout. If you log into two apps, log out of one expecting the other will log out, when it doesn't in reality, that seems like a serious security issue. As a admin, I can train myself to log out of all apps, maybe. But, for other users, that's just not guaranteed.

Implementing this would require some level of session tracking, which may be against the current statelessness goal (from what I can tell). However, its not so different from the refresh token implementation. Those are stateful of course, and maybe there are others too.

It looks like most of the plumbing is already here, so not a big lift. This will create a meaningful improvement in security posture for non-technical users who otherwise expect true SSO.

Pitch

Also, I really want to move away from keycloak