fix(identity): address auth review findings

[zagrosi-code]

Summary

• keep sign-up user creation inside the active transaction
• return session credentials and session/CSRF cookies from password sign-in
• make sign-out revoke the authenticated session and clear cookies

Tests

• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo test --workspace --all-features --no-fail-fast