feat: implement automatic SSO login redirect on admin panel, with logout protection

admin.js

@@ -1187,12 +1187,11 @@ function closeNavDrawer() {
 
 async function boot() {
   await handleCallback();
-  tokenSet = getStoredTokens();
-  if (isTokenValid(tokenSet)) {
-    storeTokens(tokenSet);
-  }
 
-  if (!isTokenValid(tokenSet)) {
+  // Check if we just logged out
+  const loggedOut = sessionStorage.getItem('mischlabs.admin.logged_out') === 'true';
+  if (loggedOut) {
+    sessionStorage.removeItem('mischlabs.admin.logged_out');
     loginPanel.hidden = false;
     adminPanel.hidden = true;
     loginButton.hidden = false;
@@ -1202,6 +1201,27 @@ async function boot() {
     return;
   }
 
+  tokenSet = getStoredTokens();
+  if (isTokenValid(tokenSet)) {
+    storeTokens(tokenSet);
+  }
+
+  if (!isTokenValid(tokenSet)) {
+    if (loginMessage.textContent) {
+      loginPanel.hidden = false;
+      adminPanel.hidden = true;
+      loginButton.hidden = false;
+      logoutButton.hidden = true;
+      const hamburgerBtn = document.getElementById('hamburgerMenuBtn');
+      if (hamburgerBtn) hamburgerBtn.style.display = 'none';
+      return;
+    }
+
+    // Automatic silent SSO login redirect
+    login();
+    return;
+  }
+
   const claims = authorize(tokenSet);
   if (!claims) return;
 
@@ -1232,6 +1252,7 @@ loginButton.addEventListener('click', login);
 const performLogout = () => {
   const idToken = tokenSet?.id_token;
   clearTokens();
+  sessionStorage.setItem('mischlabs.admin.logged_out', 'true');
   const params = new URLSearchParams({
     client_id: CLIENT_ID,
     post_logout_redirect_uri: REDIRECT_URI