fix: web login (#14378)

#### PR Dependency Tree


* **PR #14378** 👈

This tree was auto-generated by
[Charcoal](https://github.com/danerwilliams/charcoal)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added a deprecated GET sign-out endpoint for backward compatibility
with legacy clients.

* **Improvements**
* Updated magic-link and OAuth flows to always generate and manage
client nonces; native clients use a nonce, web preserves cross-device
behavior.

* **Tests**
* Added tests covering the deprecated sign-out flow and OAuth preflight
client_nonce handling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

packages/backend/server/src/__tests__/auth/controller.spec.ts

@@ -264,6 +264,23 @@ test('should be able to sign out when duplicated csrf cookies exist', async t =>
   t.falsy(sessionRes.body.user);
 });
 
+test('should be able to sign out via GET /api/auth/sign-out (deprecated)', async t => {
+  const { app } = t.context;
+
+  const u1 = await app.createUser('u1@affine.pro');
+
+  await app
+    .POST('/api/auth/sign-in')
+    .send({ email: u1.email, password: u1.password })
+    .expect(200);
+
+  const res = await app.GET('/api/auth/sign-out').expect(200);
+  t.is(res.headers.deprecation, 'true');
+
+  const session = await currentUser(app);
+  t.falsy(session);
+});
+
 test('should reject sign out when csrf token mismatched', async t => {
   const { app } = t.context;