Function generateLogoutToken

Generates a signed logout_token JWT (OIDC Back-Channel Logout 1.0 §2.4).

Claim composition:

• iss, sub, aud (required)
• iat, exp (seconds since epoch; default TTL 300s)
• jti (unique token identifier)
• events: { [BACKCHANNEL_LOGOUT_EVENT_URI]: {} } (required by spec)
• sid (session identifier; included by default, omit with includeSid: false)

Spec constraints enforced:

• nonce MUST NOT be present (§2.4)
• typ header set to "logout+jwt"