Ends a WHIP session (WHIP has no renegotiation -- reconnect means a fresh POST /api/whip/publish). Cross-user replay is structurally blocked: the internal DELETE URL is rebuilt from the CALLER's own stream key, so a guessed session_id under another user's key just 404s at whip rather than tearing down someone else's stream.

That scoping holds only while session_id stays inside its own path segment. FastAPI's {session_id} will not match a literal '/', but it DOES accept a percent-encoded one and hand it back decoded, so ..%2F..%2Fotherkey%2Fwhip%2F<id> would interpolate straight past the caller's own stream key and tear down another user's session. Hence the shape check rather than trusting the route pattern.