docs: correct docstrings and guides that disagree with the code

[allen0099]

Closes #108

Documentation and docstrings only. The one runtime string that changes is the get_session_manager 500 detail, and the existing test still matches its prefix. Behaviour is unchanged.

Changes, per item in #108

• SessionConfig.sliding_threshold: the description now says the session renews once less than this fraction of session_ttl remains. It used to describe the opposite.
• cache() docstring: each argument is described by what the code does.
  • no_cache still stores entries and still answers 304. With no_cache the header carries only no-cache (plus must-revalidate), and ttl, stale, public/private and immutable are left out.
  • stale_ttl only sets the stale-while-revalidate or stale-if-error value.
  • private bypasses the backend.
  • ttl doubles as max-age.
  • no_store takes precedence over the other options.
  • A Raises: section lists the three decoration-time CacheXErrors.
• docs/HTTP_CACHING.md, authenticated endpoints, option 2:
  • The per-user key_builder example drops private=True, which bypassed the backend so the key builder was never used.
  • Without private, the response is max-age=60, which shared caches may store. The example therefore sets Vary: Authorization through the injected Response, and a note says when to fall back to option 1.
  • I checked that the Vary header is replayed on a cache hit.
  • The snippet now imports Request/Response.
• add_routes() / get_cached_hits:
  • The docstrings no longer claim hit tracking or hit counts.
  • The CacheHit* model docstrings say the *_hits fields count entries.
  • The Example: block is fenced, and I checked that it renders as a code block in the API reference.
• BaseCacheBackend.delete_many: only memory and Redis batch; Memcached keeps the per-key loop.
• Memcached clear_path / clear():
  • clear_path is documented as deleting only the exact key.
  • clear()'s docstring and its RuntimeWarning no longer suggest clear_path() for clearing a namespace, which Memcached cannot do. They point to delete()/delete_many() for known keys instead.
• Session dependencies: the docstrings and the get_session_manager 500 message name FastAPICacheXSessionMiddleware.
• SessionManager._iter_sessions: says that the built-in Memcached backend returns [] with a warning, while a custom backend may raise NotImplementedError.
• docs/STATE.md quick start: catches StateError, so a malformed state is a 400 rather than a 500.
• CLAUDE.md / docs/DEVELOPMENT.md: describe the actual convention for forward references. Most modules use quoted annotations with TYPE_CHECKING imports; only 2 of 33 modules use from __future__ import annotations.
• CacheManager.__init__: documents BackendNotFoundError. StateManager.__init__ had the same gap and is fixed too.

The CHANGELOG has an entry under Fixed.

Verification

• ruff, mypy (strict), the full suite with live Redis and Memcached (761 passed), and zensical build --strict all pass. The commit's pre-commit hooks pass as well.