feat: move Areas to Design role, fix logout, add Sign Out button

Areas management is a design concern, not admin. Moved Areas page
authorization from RequireAdmin to RequireDesign, moved nav link from
Admin to Design section, updated ManagementActor role check. Added
GET /logout endpoint (was 404, now redirects to login). Improved Sign
Out button visibility in sidebar next to username.

src/ScadaLink.CentralUI/Auth/AuthEndpoints.cs

@@ -86,6 +86,13 @@ public static class AuthEndpoints
             context.Response.Redirect("/login");
         }).DisableAntiforgery();
 
+        // GET /logout — allows direct navigation to logout (redirects to login after sign-out)
+        endpoints.MapGet("/logout", async (HttpContext context) =>
+        {
+            await context.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);
+            return Results.Redirect("/login");
+        });
+
         return endpoints;
     }
 }