fix(client): clear protected views on logout and show customer customs state

src/modules/auth/store/authSession.test.mjs

@@ -35,7 +35,7 @@ function harness(t, expired = false) {
   class ApiError extends Error { constructor(status) { super('failed'); this.status = status } }
   const module = compile('./auth.ts', {
     vue, pinia, '@/api/session': session,
-    '@/modules/auth/api/auth': { logoutMerchant: async () => {} },
+    '@/modules/auth/api/auth': { logoutMerchant: async refresh => behavior.logout?.(refresh) },
     '@/modules/auth/utils/jwt': compile('../utils/jwt.ts'),
     '@/api/http': { ApiError, refreshAuthenticatedSession: async () => {
       session.persistTokenPair({ accessToken: token(1, 1, 1, 'refreshed'), refreshToken: 'refresh-new' })
@@ -136,3 +136,19 @@ test('stale unauthorized context response cannot clear a newer account', async t
   assert.equal(h.auth.isAuthenticated, true)
   assert.equal(h.auth.sessionRestored, true)
 })
+
+test('store logout clears immediately and late revocation failure preserves a later cross-tab login', async t => {
+  const h = harness(t); await h.auth.restoreSession()
+  const remote = deferred(); let sentRefresh
+  h.behavior.logout = refresh => { sentRefresh = refresh; return remote.promise }
+  const pending = h.auth.logout()
+  const rejected = assert.rejects(pending, /offline/)
+  assert.equal(sentRefresh, 'refresh-a')
+  assert.equal(h.auth.isAuthenticated, false)
+  assert.equal(h.session.getAccessToken(), '')
+  h.rotate(token(2, 2, 2)); await flush()
+  remote.reject(new Error('offline')); await rejected
+  assert.equal(h.auth.user.id, '2')
+  assert.equal(h.auth.isAuthenticated, true)
+  assert.equal(h.session.getRefreshToken(), 'refresh-b')
+})