fix(dashboard): address persistent auth review

tests/test_dashboard_auth_server.py

@@ -176,6 +176,35 @@ def test_logout_clears_cookie_with_matching_scope(client: TestClient) -> None:
     assert "Path=/" in header
 
 
+def test_cleanup_route_clears_cookie_and_redirects(client: TestClient) -> None:
+    response = client.get(
+        "/api/auth/cleanup",
+        headers={"referer": "https://testserver/"},
+        follow_redirects=False,
+    )
+
+    assert response.status_code == 303
+    assert response.headers["location"] == "/"
+    header = response.headers["set-cookie"]
+    assert f"{authentication.AUTH_COOKIE_NAME}=" in header
+    assert "Max-Age=0" in header
+    assert "HttpOnly" in header
+    assert "Secure" in header
+    assert "SameSite=lax" in header
+    assert "Path=/" in header
+
+
+def test_cleanup_route_rejects_cross_origin_navigation(client: TestClient) -> None:
+    response = client.get(
+        "/api/auth/cleanup",
+        headers={"referer": "https://attacker.example/"},
+        follow_redirects=False,
+    )
+
+    assert response.status_code == 403
+    assert "set-cookie" not in response.headers
+
+
 def test_cookie_token_round_trip(client: TestClient) -> None:
     response = client.post(
         "/api/auth/login",