Withdrawing a credential is a fan-out, not a field write

Logging out looks like one line: clear the stored credential. It is not. Around that credential sits everything the app derived from it or gated behind it — a feature switch the user turned on, a cached access token and the timestamp saying when it expires, a per-feature sub-switch, a cached profile name shown in the settings entry. Clearing only the credential leaves all of it behind, pointing at an account you no longer have.

The state that survives is worse than useless, because it is inconsistent in a direction the user cannot fix: a feature switch gated behind "logged in" greys out when the user logs out, so the switch reads ON and refuses to be turned OFF. Only code can clear it now, and the code that should have is the logout you just wrote.

Do the fan-out where the credential is withdrawn: