when does the sprint end ?

The Sprint ends when the timebox expires. If the team finishes their forecast early (and meets the Sprint Goal) the team should agree with the Product Owner some additional PBIs that they should complete.

Agree 100% that the sprint ends when the time box expires, regardless of whether all of the stories were completed or the sprint goal was met. If the sprint was not successful for any reason, it is a good topic for discussion in the Retrospective to identify reasons why and what can be tried differently to improve the likelihood of a successful sprint.

@ Ramsay:
Agree that one possibility for excess capacity in a sprint is to work with the Product Owner to identify additional stories that can be brought in to the sprint. This should always be done with a high amount of confidence that the additional sprint scope can be completed according to the DoD by the end of the sprint.

There are other options for the team to use excess capacity though, that do not add risk to the successful completion of the sprint. Addressing technical debt, enhancing automated testing frameworks, refactoring, cross training, knowledge transfer, other learning... all of these items can be done by team members when sprint work is finished early, and can improve productivity, quality, and capacity for future sprints.

As soon as the time box expires

Since others have answered when the Sprint ends (i.e when the time box expires), I will add more on why there is exception for Sprint wrt "can not end before time box even if work is complete"

scrum guide: Once a Sprint begins, its duration is fixed and cannot be shortened or lengthened. The remaining events may end whenever the purpose of the event is achieved, ensuring an appropriate amount of time is spent without allowing waste in the process

If you notice the character of these events,
- they are alternative to traditional meetings
- they create regularity (rhythm)

A sprint has additional character:
- it has dependence on external organization for some events - technical or domain experts for planning, key stakeholders for review, other scrum teams if they are working on same product

So, reason 1 - when the Sprint ends early, the synchronization with these external dependencies is upset.

another interesting reason 2- when Sprint ends early, another Sprint begins. Sprint is a container of four events and hence they all need to happen within the Sprint. Shortened Sprint duration now may have excess amount of these inner events, in that "there might be more time on formal inspection and adaptation than necessary" In other words the cost of formal inspection and adaptation increases when the Sprint is contracted.

Missed to add this point:

Though the temporary contraction is not allowed, Sprint can be shortened going forward from next Sprint. But, it should be well informed decision during the retrospective and the new Sprint length should be consistent. The other inner events need to be time adjusted to reflect this new length.

Sprint Ends once the Sprint time-box expires. Ideally all the sprint ceremonies should have been completed.

Any spill over of ceremonies and PBI in WIP needs to be moved to next sprint keeping Product owner in confidence.