Ensure session cookies are properly cleared on logout

Fix session persistence issue by:
- Using cookies().delete() method for both adminSession and session
- Adding explicit Set-Cookie headers with Max-Age=0 to force browser deletion
- This ensures cookies are cleared both via Next.js API and HTTP headers

Previously, sendBeacon logout calls weren't reliably deleting session cookies,
causing users to remain logged in after closing/reopening the browser.

This double approach ensures the cookies are removed from the browser cache.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

src/app/api/logout/route.ts

@@ -4,11 +4,15 @@ import { NextResponse } from 'next/server';
 export async function POST() {
   const cookieStore = await cookies();
 
-  // Clear admin session
+  // Clear both admin and customer sessions
+  // Must delete with same options they were set with
   cookieStore.delete('adminSession');
-
-  // Clear customer session
   cookieStore.delete('session');
 
-  return NextResponse.json({ success: true });
+  // Also send response with Set-Cookie headers to ensure deletion
+  const response = NextResponse.json({ success: true });
+  response.headers.set('Set-Cookie', 'adminSession=; Path=/; Max-Age=0; HttpOnly');
+  response.headers.append('Set-Cookie', 'session=; Path=/; Max-Age=0; HttpOnly');
+
+  return response;
 }