Api Whip Stop

Stop the caller's own active browser WHIP session, found server-side rather than by a session id the client must have remembered. Without this, a page reload mid-stream leaves no way to stop a browser-originated stream at all: /api/whip/publish's collision check refuses a fresh publish attempt outright (relay truth says already live), and the only other caller of _whip_kick_session is the orphan reap inside that same route, which is gated on the session NOT actually reaching the relay -- the opposite of this case.