fix: match cookie security attributes in logout clearCookie

[Mikardo001]

Overview

This PR fixes a security issue in authController.logout where the auth cookie was cleared without the security attributes used when it was set. Because res.clearCookie was called with only { path: '/' }, modern browsers could ignore the expiration directive, leaving the session cookie stored and valid after logout. The fix passes the same options used in authController.login.

Related Issue

Changes

🔒 Cookie Clearing Fix

• [MODIFY] backend/src/controllers/authController.ts
  • Updated authController.logout to call res.clearCookie with the same options used when the cookie is set in authController.login: { httpOnly: true, secure: true, sameSite: 'strict', path: '/' }.
  • Ensures the Set-Cookie expiration directive matches the original cookie's security flags so browsers reliably delete the session cookie on logout.

Verification Results

No automated test changes were included in this fix.
Manual verification: logout response now emits a Set-Cookie header
with matching httpOnly, secure, sameSite, and path attributes,
allowing the browser to remove the session cookie.

Acceptance Criteria	Status
clearCookie uses matching security attributes	✅ httpOnly, secure, sameSite: 'strict', and path: '/' now passed
Session cookie is deleted by the browser on logout	✅ Attributes match the cookie set in authController.login
Change is scoped to the logout handler	✅ Only authController.logout modified

Closes #1829