OP-side logout: end_session_endpoint and back-channel fan-out

## What happens

This site can *receive* a logout and cannot *send* one.

`core/logout.py` implements OIDC Back-Channel Logout as a relying party in full:
token validation, replay refusal by `jti`, per-user keyring rotation, and an
event the `[server]` layer subscribes to in order to revoke refresh tokens.

As an authorization server there is nothing. `server/discovery.py` advertises
authorization, token, userinfo, jwks and revocation endpoints and no
`end_session_endpoint`; `IClientRecords` declares `redirect_uris`,
`grant_types`, `scope`, `service_user`, `secret_hash` and `auth_method`, and no
`backchannel_logout_uri` or `post_logout_redirect_uris`.

## What it should do

Two specifications, best taken in order and possibly as two pull requests.

**RP-Initiated Logout 1.0**
- an `end_session_endpoint`
- `post_logout_redirect_uris` on `IClientRecords`
- `id_token_hint` validation

**Back-Channel Logout 1.0, as the provider**
- `backchannel_logout_uri` per client
- a signed logout token per registered client
- a fan-out that tolerates a client being down

Both advertised in `server/discovery.py`.

## Notes

The receiving half is the reference for the token shape, and its notes on
`plone.session`'s `per_user_keyring` apply unchanged — a site that wants this
has to turn that on.

Stays in `server/`; `make check-imports` forbids core importing it.

How much of this lands before 1.0.0 final is an open decision (Érico,
2026-09-08: postponed).