feat(session)!: reject JWT HMAC secrets shorter than the hash output

[allen0099]

Closes #129

Summary

• JWTTokenSerializer (and so SessionManager with token_format="jwt") raises ValueError when jwt_algorithm is HS384 or HS512 and secret_key is shorter than 48 or 64 bytes in UTF-8 (RFC 7518 §3.2). This replaces the 0.3.x UserWarning.
• The check runs right after the asymmetric-algorithm check and before PyJWT is imported, so a misconfiguration is reported even without the jwt extra.
• A custom token_serializer holds its own key and is not checked. HS256 is unaffected (SessionConfig already requires 32 characters).
• Docs: SESSION.md and MIGRATING_0_4.md#jwt-secret (en/zh-TW); changelog fragment 129.changed.md.

Tests

• Rejection and acceptance at each boundary for HS256/HS384/HS512, counted in UTF-8 bytes (multibyte keys on both sides of the limit).
• Rejection when SessionManager is built, before PyJWT is needed, and a custom serializer bypassing the check.
• Mutation-checked: <= instead of <, counting characters instead of bytes, dropping the raise, and moving the check after the PyJWT import each fail a test.