Log out the current session
access-control
Log out the current session
Revoke the caller’s session by fanning revoke_session out over every
presented credential candidate and every registered accounts provider.
Iterating all candidates is required: a client may present a stale value in
Authorization alongside its live session in X-Api-Key, so checking only the
first would leave that session alive. The FIRST True → {"revoked": true}.
Only when EVERY candidate against EVERY provider returns False → 404 (an
sk- API key cannot “log out” — loud, not a silent no-op), with a server-side
log naming the caller so probing/replay stays visible. Provider errors propagate
(fail closed).
POST
Log out the current session

