Reset the current browser visitor

Explicit widget shutdown/logout lifecycle. Revokes the presented browser visitor when it still resolves, without deleting conversation records. The response is idempotent so it cannot reveal whether a visitor secret was valid. Clear the locally stored secret after success; a later history-capable init creates a clean anonymous visitor. Every response carries `X-History-Identity-Status` (`not_provided` | `admitted` | `ignored`) reporting what the server did with a supplied `X-Identity-Proof`, so a widget can tell a verified action from a browser-scoped one. It is exposed via CORS; it grants no authority.