End any existing session when a sign-in is refused

A browser that still holds a session and signs in as an account outside
the household's group got the 403 page but kept its old session. The
refusal now ends that session and clears its cookie first.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/auth/auth.go

@@ -277,6 +277,13 @@ func (a *Auth) callback(w http.ResponseWriter, r *http.Request) {
 		} else {
 			a.logger.WarnContext(ctx, "sign-in refused: not in an allowed group", "subject", claims.Subject)
 		}
+		// A session this browser already holds ends too, so a refused
+		// sign-in never leaves it signed in.
+		if err := a.sessions.EndSession(w, r); err != nil {
+			a.logger.ErrorContext(ctx, "end session", "error", err)
+			http.Error(w, "internal error", http.StatusInternalServerError)
+			return
+		}
 		a.refuse(w, r)
 		return
 	}