Operator: sign a person out of every browser

Operator console only: requires the web session of an address in the operator allowlist of this installation, sent from the application itself. Every other signed-in caller and every valid Bearer token receives 404 NOT_FOUND, whether or not this installation has an operator configured; a caller with no valid credential receives 401, as on every route. Recorded in the operator log. Deletes every web session of the person; a connected app keeps working until its grant is revoked. The body gives the reason, from a closed list, and may give a reference: a ticket or card key, never an address. A person who does not exist answers 404.