/signout

Invalidates the current access token, signing the user out; returns 204 with no body.

Idempotent: the endpoint always returns 204, even if the Authorization header is missing or the token was already invalid/expired — there is no error response for this case.

Note on CSRF: This endpoint uses GET, which can be triggered passively by browsers.
However, this API is stateless and authenticates exclusively via the Authorization
bearer token header — browsers never automatically attach header-based tokens to
passive requests (img tags, prefetch, etc.). CSRF is therefore not applicable here.