feat(session)!: add logout() and login(keep=), make Session.user read-only

[allen0099]

Closes #256. This is the rest of the proposal after #415 (cookie defaults): logout(), login(keep=) and a read-only Session.user.

Changes

• await logout(request) (fastapi_cachex.session):
  • deletes the session from the backend at once, so its token stops resolving before the response is sent;
  • then goes through the request.session.clear() path, so the middleware expires a cookie client's cookie;
  • for the rest of the request, get_session finds no session, keys written afterwards start a new anonymous session, and a later login() starts a new session;
  • returns True, or False when no session was loaded or started in the request;
  • raises RuntimeError without FastAPICacheXSessionMiddleware.
• login(request, user, *, keep=...):
  • carries only the listed keys over, both from the stored record (before rotation, so the record under the new ID never holds a dropped key) and from what was written to request.session before the call;
  • keep=[] carries nothing; keys written after the call are kept;
  • a different user's session is still dropped entirely, whatever keep lists;
  • a str raises TypeError (keep="cart" would otherwise mean its letters).
• Session.user is read-only: assigning it raises AttributeError, with a message that points to login() / create_session(user=...).
  • Construction, model_validate and model_copy still accept a user; login() uses a private _attach_user().
  • The __setattr__ override is hidden from type checkers, so typos such as session.dta = ... are still reported.
• examples/session_login.py logs out with logout().
• Docs, in both languages:
  • SESSION.md: read-only user, logout(), keep=, and how logout() differs from clear().
  • MIGRATING_0_4.md#login-logout: rewritten for the implemented behaviour.
• Changelog: 256.added.md (logout(), keep=) and 256.changed.2.md (read-only Session.user).

No 0.3.9 warning for the read-only user: 0.3.x cannot tell which code assigns it, as the migration guide already says.

Tests

• New tests/session/test_logout_and_keep.py (19 tests):
  • logout() over the cookie, header and bearer transports; without a session; writes after it; login() after it; login() then logout(); outside the middleware;
  • keep= on an anonymous session, a re-login, a new visitor and another user's session, and a string argument;
  • assigning user raises, other fields stay assignable, a user can still be given when a Session is built.
• test_session_login checks the example's /logout return values.
• Mutation checks, each caught:
  • removing the __setattr__ guard;
  • skipping the request.session filter or the stored-record filter;
  • skipping the immediate delete in logout();
  • dropping the string check;
  • not emptying request.session for another user's session.
• Full suite, coverage (99.91%), mypy --strict, mypy tests / scripts, both strict docs builds and tox -e lowest pass.