fix(auth): prevent re-entrant logout calls on session expiry

[yhabib]

Motivation

When the session expires, logout() calls authStore.signOut() which sets identity to null. This triggers reactive cascades where in-flight services call getAuthenticatedIdentity(), see the missing identity, and each independently call logout() again. Each call appends duplicate URL params via .append() before the browser reloads, which can lead to oversized headers (HTTP 431).

Related to: https://forum.dfinity.org/t/proposal-140767-to-upgrade-the-nns-dapp-2026-03-06/65145/4?u=yhabib

Changes

• Added a logoutInProgress re-entrancy guard to logout() so only the first call proceeds.
• Switched appendMsgToUrl from searchParams.append() to searchParams.set() to prevent duplicate URL params as a secondary defense.

Tests

• Added a test verifying concurrent logout calls only trigger one signOut and one reload.

Todos

• Accessibility (a11y) – any impact?
• Changelog – is it needed?