Rebuild OMSORG Connect from scratch: login-only milestone

New omsorgWeb/mitarbeiter-app/ replaces the legacy PHP app for now
with just the login flow, built fresh instead of incrementally
refactored. Reuses the already-working omsorgCore JWT auth pattern
(login, silent refresh, session-stored token pair, /api/auth/me for
role+permissions) but drops everything legacy carried alongside it:
no local MySQL user cache, no admin/user-management endpoints, no
admin UI. Employee/user management stays exclusive to OMSORG Desktop
per architecture decision - Connect only ever acts on the current
user's own session.

logout.php additionally revokes the refresh token server-side via
omsorgcore_logout(), which the legacy version never did.

Verified end-to-end against a running omsorgCore instance: login,
dashboard via /api/auth/me, logout + token revocation, unauth
redirect, and wrong-credential error handling.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

omsorgWeb/mitarbeiter-app/actions/logout.php

@@ -0,0 +1,18 @@
+<?php
+require_once __DIR__ . '/../lib/auth.php';
+
+// Best-effort: Refresh-Token serverseitig widerrufen, damit er nicht bis zum natürlichen
+// Ablauf gültig bleibt. Fehler hier dürfen den lokalen Logout nicht blockieren.
+if (!empty($_SESSION['omsorgcore_refresh_token'])) {
+    omsorgcore_logout(_omsorgcore_config(), $_SESSION['omsorgcore_refresh_token']);
+}
+
+$_SESSION = [];
+if (ini_get('session.use_cookies')) {
+    $p = session_get_cookie_params();
+    setcookie(session_name(), '', time() - 42000,
+        $p['path'], $p['domain'], $p['secure'], $p['httponly']);
+}
+session_destroy();
+header('Location: ../index.php');
+exit;