Login/logout UI + logged-in state + profile image

Status: ✅ Done — with one external caveat on logout.

The account entry in the site header, gated on the oidc feature flag and SSR-safe: it is absent from the cached anonymous HTML and appears only after mount when the flag is on, covering both desktop and mobile via the shared menu data.

• When logged out, an "Account" menu presents a "Sign in" action (oidcLogin()).
• When logged in, the menu shows the user's name (falling back to preferred_username, then "Account") and, when the picture claim is present, their avatar; a GraphicsBustInSilhouette icon is available as a fallback. The menu presents a "Sign out" action.
• Red builds no account-management UI — that lives in Authentik; Red only links out and reads claims.

Logout caveat (external, not a Red code issue): "Sign out" calls signoutRedirect() for a full end-session, ending the Authentik SSO session rather than just the local one. Red's request is spec-correct (a valid id_token_hint plus a registered post_logout_redirect_uri), but Authentik does not redirect back to Red. This might be due to this bug https://github.com/goauthentik/authentik/issues/10430
post_logout_redirect_uri is a new feature in Authentik 2026.5 (#20011) that shipped with a regression: it broke in 2026.5.2, was partially fixed in 2026.5.3, and still fails on our 2026.5.5 install. The fix is to upgrade Authentik to a release where the feature works; no Red code change is required.

The issue marks the Red implementation as done and names no files, tests, or entry points. Read the existing account entry and shared menu implementation first if verification is needed; done means the gated sign-in and sign-out UI, claims-based profile display, avatar fallback, and desktop/mobile behavior match the description. Logout redirection depends on the external Authentik installation.