feat(session): add explicit leave and immediate slot release

docs/PROTOCOL.md

@@ -39,6 +39,9 @@ is only echoed for correlation; it grants no authority.
 - `restart`: `{}`. Only connected Player 1 may reset a finished match, and both
   players must be connected. Sessions are preserved while a new authoritative
   maze and game state are created.
+- `leave`: `{}`. Revokes only the authenticated sending session. A player
+  leaving an unfinished match cancels it for all participants; observer and
+  waiting-lobby departures release only that session.
 - `heartbeat`: `{}` after a session has been joined or restored.
 
 ## Server messages
@@ -60,7 +63,10 @@ is only echoed for correlation; it grants no authority.
 - `match_result`: reports the terminal winner or draw.
 - `reset`: reports the authoritative return from a finished match to the
   waiting lobby.
-- `ack`: successful heartbeat correlation.
+- `ack`: successful heartbeat correlation. A heartbeat acknowledgement has
+  `payload.command` set to `heartbeat` and a bounded integer
+  `payload.handlingMs` measured only by the ESP monotonic clock while it
+  prepares that acknowledgement.
 - `error`: a stable English `code` and Russian player-facing `message`.
 
 An observer session can receive snapshots but cannot issue `start`, `move`, or