fix(admin): keep list state in the URL and browser storage

- listState.ts stores each list's query (search, sort, dir, page, per_page,
  filter[name]) under summer-admin.list:<controller>; an empty query is
  never stored, malformed stored values are dropped like a hand-edited URL
- ListView restores the stored query into the URL before its first list
  request when entered without list params; a URL with list params wins
- a 422 forgets the stored query; an out-of-range page clamps to last_page
- logout clears every stored list query
- check-phase10.sh allows browser storage in useSidebar.ts and listState.ts
- list smoke tests start from a clean list state
- rebuilt modules/boardwalk/dist

admin/src/state/useAuth.ts

@@ -4,6 +4,7 @@ import { readonly, ref } from 'vue'
 import type { Router } from 'vue-router'
 import { api, onRefreshed, refreshSession } from '../api/client'
 import type { AdminProfile } from '../api/types'
+import { clearListStates } from './listState'
 import { setNavigation } from './useNavigation'
 import { setSettings } from './useSettings'
 
@@ -82,8 +83,9 @@ export function clearUser(): void {
 
 /**
  * Ends the session: POST /auth/logout (the server blacklists the token and
- * expires the HttpOnly cookie), then clears the in-memory user, navigation
- * and settings and routes to the login screen. The local state is cleared
+ * expires the HttpOnly cookie), then clears the in-memory user, navigation,
+ * settings and stored list queries (so the next admin on this browser sees
+ * none of the previous searches) and routes to the login screen. The local state is cleared
  * and the login screen shown even when the call fails (T-10-23).
  */
 export async function logout(router?: Pick<Router, 'replace'>): Promise<void> {
@@ -93,6 +95,7 @@ export async function logout(router?: Pick<Router, 'replace'>): Promise<void> {
     // Network failure: the session still ends on this device.
   } finally {
     clearUser()
+    clearListStates()
     setNavigation([])
     setSettings([])
   }