Ends the support session the CALLER is running under — the operator closing their
own session when the work is done, without waiting for the token to expire or the
tenant to withdraw the authorisation.

The session is resolved from the caller's own token, never from an identifier in the request. "Current" means the session whose impersonator is this token's act.sub, on the tenant in the path. There is no session id and no JTI anywhere in the request: accepting either would let a caller holding one impersonation token terminate a different operator's session by guessing an identifier, and a JTI in a request is also a JTI in a log.

A caller running under no impersonation context is refused 403 — it is not a request this endpoint can answer, and answering it as a no-op would report success for a session that was never the caller's.

Always 204, never 404. Ending when nothing is open is a

successful no-op; a 404 would report whether a session exists.