Add JSON format support to session destroy for native API clients

This is so that native API clients can get the session record deleted
server-side. They still need to take care of clearing any cookies
they've set in web views.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

test/controllers/sessions_controller_test.rb

@@ -117,4 +117,15 @@ class SessionsControllerTest < ActionDispatch::IntegrationTest
       assert_response :unprocessable_entity
     end
   end
+
+  test "destroy via JSON" do
+    sign_in_as :kevin
+
+    untenanted do
+      delete session_path(format: :json)
+
+      assert_response :no_content
+      assert_not cookies[:session_token].present?
+    end
+  end
 end