Fix logout cookie name mismatch

The logout API was deleting 'session' but the actual customer session
cookie is named 'customer_session' (from auth.ts SESSION_COOKIE).

This fix ensures the logout properly clears the customer session, so users
are actually logged out when the browser closes.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

src/app/api/logout/route.ts

@@ -5,14 +5,15 @@ export async function POST() {
   const cookieStore = await cookies();
 
   // Clear both admin and customer sessions
-  // Must delete with same options they were set with
+  // Customer session cookie is named 'customer_session' (from auth.ts)
+  // Admin session cookie is named 'adminSession'
+  cookieStore.delete('customer_session');
   cookieStore.delete('adminSession');
-  cookieStore.delete('session');
 
   // Also send response with Set-Cookie headers to ensure deletion
   const response = NextResponse.json({ success: true });
-  response.headers.set('Set-Cookie', 'adminSession=; Path=/; Max-Age=0; HttpOnly');
-  response.headers.append('Set-Cookie', 'session=; Path=/; Max-Age=0; HttpOnly');
+  response.headers.set('Set-Cookie', 'customer_session=; Path=/; Max-Age=0; HttpOnly');
+  response.headers.append('Set-Cookie', 'adminSession=; Path=/; Max-Age=0; HttpOnly');
 
   return response;
 }