feat: harden the myep OAuth2 login

templates/layout.html.twig

@@ -15,11 +15,16 @@
             {% if app.user %}
                 <div class="flex items-center gap-4">
                     <span class="hidden sm:block text-sm text-gray-500">{{ app.user.name }}</span>
-                    <a href="{{ path('app_logout') }}"
-                       class="flex items-center gap-2 text-sm font-semibold text-gray-700 hover:text-gray-900">
-                        {{ ux_icon('lucide:log-out', { class: 'h-5 w-5 shrink-0 text-gray-400' }) }}
-                        <span class="hidden sm:inline">Abmelden</span>
-                    </a>
+                    {# A form rather than a link: the firewall's logout is CSRF-protected, so any
+                       third-party page embedding the URL gets nowhere. #}
+                    <form method="post" action="{{ path('app_logout') }}">
+                        <input type="hidden" name="_csrf_token" value="{{ csrf_token('logout') }}">
+                        <button type="submit"
+                                class="flex items-center gap-2 text-sm font-semibold text-gray-700 hover:text-gray-900 cursor-pointer">
+                            {{ ux_icon('lucide:log-out', { class: 'h-5 w-5 shrink-0 text-gray-400' }) }}
+                            <span class="hidden sm:inline">Abmelden</span>
+                        </button>
+                    </form>
                 </div>
             {% endif %}
         </div>