fix(oidc-auth): delete domain-scoped session cookie on invalidation

[ChethankumarGS]

Follow-up to #1490. That fix covered revokeSession(), but the other session-invalidation paths still call deleteCookie() without the configured OIDC_COOKIE_DOMAIN. A cookie's identity is its (name, domain, path) triple, so the domain-scoped session cookie - the one updateAuth() actually sets - survives invalidation and the session stays alive.

Changes:

• Add a deleteSessionCookie() helper (same delete-both pattern as revokeSession()) and use it in getAuth() (invalid JWT, empty refresh token, rejected refresh grant), the oidcAuthMiddleware() catch block, and revokeSession() itself
• Delete the state / nonce / code_verifier / continue flow cookies in processOAuthCallback() with the domain they were set with
• Include the configured domain in the session-cookie re-set after next(), so it matches updateAuth() instead of creating a divergent host-only cookie

Tests: three regression tests covering invalidation with OIDC_COOKIE_DOMAIN set (invalid JWT, rejected refresh grant, renewal without a host-only duplicate). All three fail on main and pass with the fix; the full @hono/oidc-auth suite passes (45 tests).

Fixes #2174

[changeset-bot]

🦋 Changeset detected

Latest commit: 9338711

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@hono/oidc-auth	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR