End the cookie session

Clears the __Host-dre-session cookie. Always 204, whether or not a session was present — a client can call it to recover from an expired or unreadable session. Takes no body and needs no CSRF token.

Local logout only: a bearer JWT already issued to a client stays valid until it expires. There is no server-side revocation.