Invalidates the supplied refresh token, ending the session it belongs to.
Deliberately takes no session credential: sign-out legitimately runs with an
already expired access token, so requiring one would break the case this
endpoint exists for. The refresh token in the body is the only credential.

Idempotent — a token that is unknown or already invalidated still returns
200, so repeated sign-outs are harmless and the response never reveals
whether a given token exists.