Merge pull request #512 from paulmeier/fix/oidc-sso-state-403-510

fix(oidc): make SSO callback idempotent + evict stale legacy service worker (#510)

frontend/src/routes/+layout.svelte

@@ -11,6 +11,7 @@
 	import { session } from '$lib/stores/session.svelte';
 	import { ui } from '$lib/stores/ui.svelte';
 	import { hashUrlToPath } from '$lib/utils/hashRedirect';
+	import { killLegacyServiceWorker } from '$lib/utils/killLegacyServiceWorker';
 
 	let { children } = $props();
 
@@ -35,6 +36,8 @@
 	let ready = $state(false);
 
 	onMount(async () => {
+		await killLegacyServiceWorker();
+
 		// The instant HTML boot splash has done its job — the app is mounted, so
 		// the route (login renders immediately; protected routes show their own
 		// loading state) is already in the DOM behind it.