Called by the counterparty to reject the invite.
Moves the escrow to cancelled and marks the invite as declined.
The initiator is notified via the existing DB trigger.
JWT access token obtained from /auth-verify (login context) or /auth-signup. Set the bearer_token environment variable in your API client to apply it globally.