Function idp_logout 

pub async fn idp_logout(
    pool: &PgPool,
    sub: &str,
) -> AppResult<Option<IdpLogout>>

The identity provider logged the user with the subject sub out (OpenID Connect Back-Channel Logout, issue #173 step 9): their browser sessions end and the time is noted (users.idp_logout_at). An unknown subject does nothing (None). API and desktop tokens stay.

Invariants

• Permission: none – the caller has checked the provider’s signed logout token (oidc::OidcClient::verify_logout_token).
• Locks: the user row (FOR UPDATE).
• Audit: user.idp_logout (by the system) with the number of sessions ended.
• Notifications / webhooks: none.
• Atomic: one transaction.