HostAppAPI: logout() or getIdToken() for Flows apps with hideShell

Problem

Smart Factory is a Flows custom app that runs inside the CDF iframe with hideShell=true. In that mode users cannot open the Fusion account menu to sign out.

HostAppAPI from connectToHostApp (@cognite/app-sdk) already exposes getAccessToken(), getProject(), getBaseUrl(), navigateExternal, and setHideShell (see Flows Auth API). It does not provide a way to end the Cognite Auth / Fusion session from the app:

• There is no logout() (or similar) on HostAppAPI.
• Cognite Auth RP-initiated logout (end_session_endpoint at https://auth.cognite.com/oauth2/sessions/logout) expects an id_token_hint. The host only exposes a CDF access token via getAccessToken(), not an ID token.
• Fusion’s own logout uses that end-session endpoint with id_token_hint and post_logout_redirect_uri. From the iframe we cannot obtain a valid id_token_hint.

We also cannot use setHideShell(false) just to expose Cognite’s logout UI.

Proposed solution

Extend HostAppAPI with one of:

1. logout(options?) – the host clears the Cognite Auth / Fusion session and sends the user to the usual post-logout entry (for example the org selector), with a documented redirect option if that fits.
2. getIdToken()– so the app can call the OIDC end-session endpoint with a proper id_token_hint via navigateExternal.

Either approach would let custom apps sign the user out while the shell stays hidden.