docs(session): align session docs and docstrings with the code

[allen0099]

Docs/docstring accuracy audit of the session subsystem: fastapi_cachex/session/ docstrings and comments, docs/SESSION.md, docs/JWT_CLAIMS.md and their zh-TW mirrors. Documentation only; the AST check confirms the .py changes touch docstrings and comments only.

Corrections

• SESSION.md (table + migration section, EN/zh-TW): the text said a brand-new session always gets Set-Cookie. In the code the transport depends on whether the request sent a header/bearer token, even one that no longer resolves. If it did, the new session's token goes back in the header_name response header.
• SESSION.md table (EN/zh-TW): the deprecated SessionMiddleware also sends a token for a regenerated ID, not only a renewed one.
• SESSION.md (EN/zh-TW): the Basic Usage model is Credentials (examples/session_api.py), but two snippets referred to a LoginRequest model from that section.
• SESSION.md (EN/zh-TW): PyJWT emits InsecureKeyLengthWarning only in 2.11 and later. The declared floor is 2.9.0, which does not have it (checked against 2.9.0, 2.10.1, 2.11.0 and the latest release).
• SESSION.md "SessionManager at a glance" (EN/zh-TW): a JWT with a bad signature, an expired exp or a wrong iss/aud raises SessionTokenError. SessionSecurityError covers only a bad simple signature or a binding mismatch.
• SESSION.md (EN/zh-TW): the cookie-default FutureWarning fires when the middleware is constructed, when the app builds its middleware stack, not at add_middleware(). Also, cookie_max_age=0 omits Max-Age just as None does.
• JWT_CLAIMS.md (EN/zh-TW): a sliding renewal goes back through the request's transport (Set-Cookie for a cookie), not always in the header_name header.
• Docstrings:
  • JWTTokenSerializer said exp is derived from session_ttl. It is the session's expires_at, with iat + session_ttl only as a fallback.
  • Added the missing Raises/Warns sections to JWTTokenSerializer.__init__, from_string, SessionManager.__init__, and the __init__ of both middlewares.
  • SessionManager.get_session Raises now matches the real split between SessionTokenError and SessionSecurityError, and says an expired session is saved as EXPIRED.
  • get_session_manager's FutureWarning also fires when the proxy holds no manager.
  • _write_session also runs for a user session emptied with del/pop.
  • The FastAPICacheXSessionMiddleware class docstring now covers the header/bearer transport.
  • Added Args/Returns to create_anonymous_session.
  • Added the ValueError contract to TokenSerializer.from_string.

Possible code issues (not changed)

• fastapi_cachex/session/middleware.py:656-660: cookie_max_age=0 (and negative values, which are not validated) is treated like None because of a truthiness check. The field description says only None disables Max-Age.
• fastapi_cachex/session/config.py:88-91: the sliding_expiration field description reads "refresh session expiry on each access". Renewal only happens once less than session_ttl * sliding_threshold remains. This is a code string, so it was left alone.