MCP `sessions` ends one sign-in, so a lost device is signed out from anywhere

Intent: a person who lost a laptop signs it out from their agent. Second half of #4796.

Done:

[ ] MCP sessions takes action: "end" and id, and calls what DELETE /api/v1/users/:username/sessions/:id calls, with the same rules
[ ] The ended session's cookie then answers as signed out; ending your own current session says so in the says sentence
[ ] An unknown id, or another person's session, is refused as the route refuses it
[ ] The docs/MCP.md row names end
[ ] Tests for all three cases in test/mcp-sessions.test.ts, and test/mcp-size.test.ts passes

MCP `sessions` ends one sign-in, so a lost device is signed out from anywhere #5148