fix!: return Observable from logoffLocal and logoffLocalMultiple

[FabianGosebrink]

⚠️ Breaking change

Callers of OidcSecurityService.logoffLocal() and logoffLocalMultiple() must now .subscribe() (or pipe into something that gets subscribed) for the logoff to actually fire.

// Before
this.oidc.logoffLocal();

// After
this.oidc.logoffLocal().subscribe();

Summary

• Return type: void → Observable<unknown> for both logoffLocal() and logoffLocalMultiple().
• Internal .subscribe() replaced with pipe(map(...)) — idiomatic lazy RxJS.
• JSDoc updated to spell out the new contract.
• The one in-repo consumer (sample-code-flow-http-config/home.component.ts) updated to follow the new pattern.

Fixes #2066

Why

Previously these two methods:

• Returned void while subscribing internally to ConfigurationService.getOpenIDConfigurations().
• Had no error handler on the internal subscribe (errors went to Angular's global error handler with no context).
• Gave callers no way to await, chain, or know when the logoff was done.
• Were the only logoff* / revoke* methods on the service that returned void — all siblings already return Observable.

Issue #2066 explicitly asks for Promise/Observable return. This brings the two outliers in line with the rest of the public surface.

Migration

Anywhere you call these methods today, append .subscribe():

- this.oidcSecurityService.logoffLocal();
+ this.oidcSecurityService.logoffLocal().subscribe();

- this.oidcSecurityService.logoffLocalMultiple();
+ this.oidcSecurityService.logoffLocalMultiple().subscribe();

Now you can also do things you couldn't before:

// Wait for logoff before navigating
this.oidcSecurityService.logoffLocal().subscribe(() => {
  this.router.navigate(['/goodbye']);
});

// Or await it
await firstValueFrom(this.oidcSecurityService.logoffLocal());

Test plan

• Existing 2 tests rewritten as 4 (lazy-vs-subscribed pair per method)
• Full library test suite: 985 / 985 SUCCESS
• npm run lint-lib clean
• In-repo sample app updated

Out of scope (intentionally)

• The nested-subscribe in periodically-token-check.service.ts:83-96 was also flagged in the original analysis as "subscription leak." It actually subscribes to an auto-completing of()-based observable, so there's no real memory leak — but the pattern is still ugly. Better handled in its own focused PR that refactors the periodic-check pipeline.
• No new methods (logoffLocal$ etc.) added — the existing names are now Observable, matching the sibling methods.

🤖 Generated with Claude Code