docs(session): show a login that sets session.user

[allen0099]

The session guide's login examples write request.session["user_id"] = "123". That is application data: session.user stays None, so require_user_session / AuthenticatedSession answer 401 for such a session. The same guide recommends those dependencies for routes that need a logged-in user, so following it produced a login that never authenticates.

This PR documents the working pattern (found while writing examples/session_login.py, #291):

• docs/SESSION.md section 2: states that only create_session(user=...) or assigning session.user and saving sets the user, and that request.session keys are not a login.
• docs/SESSION.md section 5: a second example that rotates the ID, assigns session.user, and calls update_session(). The explicit save is needed because assigning session.user does not mark request.session as modified. Links to examples/session_login.py for the full version, including the cookie for a new visitor.
• The rotate_session_id docstring gets the same note.
• zh-TW mirrors of both guide changes.

Docs only; no behaviour change. The pattern is exercised by tests/test_examples.py (session login example).

Refs #293 (a login() helper that removes these steps, planned for 0.3.9).

CHANGELOG

Under ### Documentation:

- **Logging a user in.** The session guide now shows how to attach a
  `SessionUser` at login so `require_user_session` and
  `AuthenticatedSession` accept the session; writing to `request.session`
  alone does not.