Reset Goal Browser Session

Start over: this browser gets a new session, and so a new conversation.

Field-found on the voice e2e (#1947): there was no way to begin again. GET /goals/session keeps a live cookie's session on purpose — that is what makes a conversation survive a reload — GET /goals/conversation resumes the durable one, and nothing rotated either, so "new goal" could only navigate back to the same conversation forever.

Unsafe, taking the same three signals every unsafe goals route takes, because from the athlete's point of view this ends their conversation: a cross-site page that could reach it could throw away work somebody is in the middle of. The answer is shaped exactly like the bootstrap's — replacement cookie, fresh CSRF token, the new session's id and expiry — so a client swallows it with the code it already has for GET /goals/session.

The old goal session is left to its TTL rather than deleted; :meth:~cheshire.resources.browser_sessions.BrowserSurface.rotate says why.

An active voice call is not this route's business. The audio is held between the browser and the voice service, so nothing here could end one; the client hangs up first, and a call left running would only be delegating turns onto a session its own page no longer holds.