Unsubscribe from web push

Deactivate a browser push subscription by its endpoint. Keyed by the endpoint URL (a high-entropy capability) rather than the user, so the client can unsubscribe during logout after the login token has been cleared. Still requires the application API key. Idempotent — an unknown endpoint returns 200.