Soft-deactivate the push subscription identified by the given endpoint URL.

The row is NOT deleted. Setting is_active=False preserves the audit trail and lets the push sender skip it without raising an error on the push service (which would return 410 Gone for a truly revoked endpoint).

Only the current user's own subscriptions may be deactivated. Requests for an endpoint that does not exist or belongs to another user return 404 so callers cannot enumerate other users' endpoints.

Rate limited to 10 requests per minute per user (keyed by user id).

Required JSON body fields: endpoint (str) — The push service URL to deactivate.

Returns 200 on success, 404 if the endpoint is not found for this user. Returns 429 if the caller exceeds the rate limit.