What can't be undone asks first

Deleting a post, taking it off the persona's wall, muting or blocking an account (from a card or a profile), leaving
a group, dropping a scheduled post and signing out acted at the first tap, a few pixels from their neighbours. They now
ask first: new ConfirmService (Ask returns whether the reader confirmed, as PublicNoticeService does) and ConfirmHost in
MainLayout, a sheet from the bottom on a phone and a dialog from md, with Cancel and the action named, in red when it
deletes or cuts off. Logout is a button that asks, then goes to /logout as before. The reversible ones (unmute,
unblock, removing a conversation from the list, a picture from the composer) don't ask; the inline confirms of lists,
filters and the login's deletion stay. The desktop tests that delete a reply, take a post off a wall or drop a
scheduled post confirm; a phone flow deletes a post after cancelling once.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LsXgEaXee4GCU1hwYgPJXw

Shared/NavMenu.razor

@@ -89,10 +89,10 @@
 				</AuthorizeView>
 				@if (CascadingState.IsSignedIn)
 				{
-					<NavLink ActiveClass="btn-active" class="btn justify-start" href="logout">
+					<DButton class="justify-start" OnClick="Logout" data-logout>
 						<i class="ion-md-log-out text-error"></i>
 						<span>@Localizer["Logout"]</span>
-					</NavLink>
+					</DButton>
 				}
 				else
 				{
@@ -139,6 +139,8 @@
 </nav>
 
 @code {
+	[Inject] ConfirmService Confirm { get; set; }
+
 	bool isMenuOpen;
 	bool isPersonaMenuOpen;
 
@@ -188,6 +190,14 @@
 
 	private void ToggleNavMenu() => isMenuOpen = !isMenuOpen;
 
+	async Task Logout()
+	{
+		isMenuOpen = false;
+		if (!await Confirm.Ask(Localizer["Log out?"], Localizer["Every persona of this login is signed out on this device."], Localizer["Logout"], true))
+			return;
+		Navigation.NavigateTo("logout");
+	}
+
 	protected async Task ResetToOriginalColour()
 	{
 		var isDark = IsDark;