fix: allow signOut to work outside middleware coverage

[nicknisi]

Summary

This PR fixes issue #261 by enabling signOut() to function when called from routes not covered by the AuthKit middleware.

Problem

Previously, when users implemented custom middleware (as documented), the signOut() function would fail because it relied on withAuth() which requires the AuthKit middleware to be running. This meant users could only clear the local session cookie but couldn't properly log out from the WorkOS domain.

Solution

• Falls back to reading the session directly from the cookie when withAuth() throws
• Extracts the session ID from the access token in the cookie
• Maintains backward compatibility by re-throwing errors when unable to recover
• Ensures proper logout from WorkOS domain even without middleware

Changes

• Modified signOut() in src/auth.ts to catch errors from withAuth() and attempt recovery
• Exported getSessionFromCookie() from src/session.ts for internal use (not publicly exported)
• Added comprehensive tests for the new behavior

Testing

Added tests to verify:

• ✅ signOut works with session cookie outside middleware
• ✅ Original error is thrown when no session exists
• ✅ Cookie is always deleted, even when errors occur

Fixes #261