Release a Gladia live session that was never bridged

Sends stop_recording to the Gladia session named by the ticket, over a plain server-to-server WebSocket, and closes it. Deliberately plain HTTPS on this endpoint's own side — not a WebSocket the client has to open — because the failure mode it exists for is a session created via POST /v1/dictation/live whose relay WebSocket never bridged (network blocks the WS upgrade, the client crashed between create and connect, and similar). A WS-based release would be unavailable in exactly that case. Reuses the same ticket embedded in relay_url's ticket query param — no separate credential. Idempotent: releasing an already-closed session is not an error. Accepts a ticket whose signature is valid but whose 60s exp has already passed, within a 15-minute grace window — the dominant trigger for release is a 4401 relay close, which IS an expired ticket, so strict expiry here would make the fix for that case fail on exactly the ticket it needs to release. Requires Authorization: Bearer <token> like every other route on this router, and additionally checks that the ticket's user_id matches the authenticated caller — required once expired tickets are accepted, so a replayed ticket can only ever stop the presenting caller's own session.