Add Cancel to the sign-out page, and icons to both buttons

Sign Out keeps btn-primary and gains a log-out icon; Cancel sits beside it as a
plain button with a back arrow.

Cancel links to "/" rather than the Referer header. "/" already resolves per
tenant -- club home on a club subdomain, control panel on the base domain --
whereas Referer can be absent or point off-site, which is not something to render
as a link unchecked.

It is an anchor, not a submit, so it cannot post the form: a test asserts that
clicking it leaves the session signed in.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

authentication/tests.py

@@ -362,3 +362,29 @@ class ActionBarTests(TestCase):
 
         self.assertContains(response, "btn-error")
         self.assertContains(response, 'type="submit"')
+
+
+class SignOutPageTests(TestCase):
+    def setUp(self):
+        self.user = User.objects.create_user(email="mfa@example.com", password="pw-secret-123")
+        self.client.force_login(self.user)
+        self.response = self.client.get(reverse("account_logout"))
+
+    def test_sign_out_and_cancel_sit_side_by_side_with_icons(self):
+        html = self.response.content.decode()
+        cancel = html[html.index('<a class="btn gap-2" href="/">') :]
+        sign_out = html[html.index('<button class="btn btn-primary gap-2"') :]
+
+        self.assertIn("<svg", cancel[: cancel.index("</a>")])
+        self.assertIn("<svg", sign_out[: sign_out.index("</button>")])
+
+    def test_cancel_does_not_sign_you_out(self):
+        # It is a link, not a submit: only the POST logs you out.
+        self.client.get("/")
+
+        self.assertTrue(self.client.session.get("_auth_user_id"))
+
+    def test_signing_out_still_works(self):
+        self.client.post(reverse("account_logout"))
+
+        self.assertIsNone(self.client.session.get("_auth_user_id"))