Sessions: what they are for and their rough edges

[Astn]

Two new subsections under "Sessions and context" in the README, which the docs site builds from.

• What sessions are for: API versions, tenants, connection-scoped method sets, capability sets, migration and experiments, per-session wire compatibility, several surfaces in one process (the HTTP endpoint's SessionSelector).
• Rough edges: a session id is routing, not authorisation; lifetime is manual; registration makes every thread refresh its registry view, so not per request; a bound instance is shared across concurrent calls (the resolver overload and scoped DI lifetimes give per-call instances); the parameterless JsonRpcService constructor and the session-less Config handler setters land on the default session; separate method tables are not a compatibility layer; some settings are process-wide or per call.

Each claim was checked against the tree: Handler.TryGetSessionHandler and UnknownSessionHandler for unknown ids, the per-thread registry version for the refresh cost, JsonRpcService(bool autoBind), the Config overloads, and JsonRpcOptions.SessionSelector (HTTP only). The paragraph on context now sits under its own "Context" heading so the two lists do not split it from the request-id subsection.

benchmarks/charts/render.py --check passes and site/build.py renders the new headings.