Harden subscribe resume and sign-out paths

Address PR review: avoid reintroducing cleared URL markers,
treat already-closed sessions as successful logout, and stop
stale subscribe/sign-out completions from racing the UI.

Signed-off-by: Émile Ré <emile@probo.com>

pkg/server/api/trust/v1/auth_resolvers.go

@@ -196,13 +196,14 @@ func (r *mutationResolver) SignOut(ctx context.Context) (*types.SignOutPayload,
 
 	err := r.iam.SessionService.CloseSession(ctx, session.ID)
 	if err != nil {
-		if _, ok := errors.AsType[*iam.ErrSessionNotFound](err); ok {
-			return &types.SignOutPayload{Success: true}, nil
+		_, notFound := errors.AsType[*iam.ErrSessionNotFound](err)
+		_, expired := errors.AsType[*iam.ErrSessionExpired](err)
+		if !notFound && !expired {
+			r.logger.ErrorCtx(ctx, "cannot close session", log.Error(err))
+			return nil, gqlutils.Internal(ctx)
 		}
-
-		r.logger.ErrorCtx(ctx, "cannot close session", log.Error(err))
-
-		return nil, gqlutils.Internal(ctx)
+		// Already closed or missing — still clear the cookie so the browser
+		// drops the stale session on concurrent / retried logout.
 	}
 
 	w := gqlutils.HTTPResponseWriterFromContext(ctx)