Thank you for your reply! I realized that this problem ultimately is all about managing the user on the main site.
If the user manually logs out of the main site, then I have to call Discourse (via API) to log them out there as well.
And if the user doesn’t log out but their session expires, I have to call Discourse to log them out there at the same time.
And finally: when a user logs out of Discourse using “log out” there, I need to capture that event (via webhook) and log them out on my site too.
Whee, integration!