Fix stale g.user after grant revocation on logout

_load_user runs before _check_auth_state, so g.user was already set
when the grant was found revoked. The session was cleared but g.user
stayed populated, causing the template to render the signed-in UI
for one request after logout. Now sets g.user = None alongside the
session clear.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

shared/infrastructure/factory.py

@@ -179,6 +179,7 @@ def create_base_app(
                         qs.pop("uid", None)
                         qs.pop("grant_token", None)
                         qs.pop("cart_sid", None)
+                        g.user = None
                         return
 
                 from sqlalchemy import select
@@ -199,6 +200,7 @@ def create_base_app(
                     qs.pop("uid", None)
                     qs.pop("grant_token", None)
                     qs.pop("cart_sid", None)
+                    g.user = None
                 return
 
             # Case 2: not logged in — prompt=none OAuth (GET, non-HTMX only)