fix(session): reject asymmetric JWT algorithms the built-in serializer cannot sign

[allen0099]

Closes #86. This is option 1 from the issue: validate early.

Problem

SessionConfig.jwt_algorithm accepts RS*, ES*, PS* and EdDSA, but JWTTokenSerializer signs and verifies with the single secret_key string. Such a configuration started up fine, then the first create_session() failed inside PyJWT (InvalidKeyError).

Change

• JWT_HMAC_ALGORITHMS (HS256/HS384/HS512) in session/config.py lists what the built-in serializer can use.
• JWTTokenSerializer.__init__ raises ValueError for any other algorithm. Because SessionManager builds the serializer in its constructor, the error now appears at startup. The message names both fixes: use an HS algorithm, or pass a custom token_serializer.
• SessionConfig still accepts every algorithm it accepted before. A SessionManager that gets its own token_serializer never builds the built-in serializer, so it is unaffected.
• The only configurations that now fail are ones that could never create a session. That is why this is a fix rather than a breaking change.
• docs/JWT_CLAIMS.md and docs/SESSION.md describe the new behavior. CHANGELOG.md gains a Fixed entry.

Real key-pair support (option 2, jwt_private_key/jwt_public_key) is left for a later feature.

Tests

• Asymmetric algorithms are rejected by the serializer (6 cases).
• SessionManager fails at construction for RS256.
• A custom serializer with RS256 is still accepted.
• HS256/384/512 round-trip through real PyJWT.
• On the old code, 7 of these 11 fail (the rejection and startup cases); the other 4 describe behavior that already worked.
• Full suite: 531 passed and 146 skipped. The skips are the Redis/Memcached live suites; no test servers were running. Coverage is 92%.

Note

Rebased onto master after #91 merged: the ### Fixed section under [Unreleased] now holds both entries.