web: logging out ends the studio session, not just the cookie

A session followed the browser, not the account: log in, open a frame, log
out, come back as a guest — the same photo stood on the stage, because the
studio's own store (localStorage knobs + the photo in IndexedDB) outlived the
cookie with nothing to clear it.

clearSession() now drops both, and the three log-out buttons call it. The
studio's own button reloads after the delete has committed — a reload mid-
delete aborts the transaction, so the promise resolves on tx.oncomplete, not
on the request. The account's frames are untouched: they reopen from MY
PHOTOS.

docker/frontend/src/engine/session.ts

@@ -88,3 +88,31 @@ export async function loadPhoto(): Promise<{ name: string; bytes: Uint8Array } |
     return null;
   }
 }
+
+// Signing out ends the session: drop the knobs and the working photo, so the
+// next visit — guest or another account — opens the studio empty. The account's
+// own photos stay in MY PHOTOS, ready to reopen.
+//
+// Async on purpose: the caller reloads the moment this returns, and a reload
+// aborts a delete still in flight. Resolve on the transaction's completion, not
+// on the request's success, or the bytes outlive the logout.
+export async function clearSession(): Promise<void> {
+  try {
+    localStorage.removeItem(STATE_KEY);
+  } catch {
+    // Nothing to clear.
+  }
+  try {
+    const db = await openDb();
+    await new Promise<void>((resolve, reject) => {
+      const tx = db.transaction(STORE, 'readwrite');
+      tx.objectStore(STORE).delete(PHOTO_KEY);
+      tx.oncomplete = () => resolve();
+      tx.onerror = () => reject(tx.error);
+      tx.onabort = () => reject(tx.error);
+    });
+    db.close();
+  } catch {
+    // Private mode / no IndexedDB: there is nothing stored to forget.
+  }
+}