Delete Session

Sign out: revoke the cookie's session server-side and expire the cookie.

Deliberately unauthenticated and idempotent: it only ever revokes the session named by the caller's own cookie, and the dashboard calls it on the 401-bounce path where no valid credential exists anymore. Unlike the read path in deps.py it applies no Sec-Fetch-Site check: SameSite=Strict already keeps cross-site requests from carrying the cookie, and the worst a forged call could do is sign the operator out.