Exchange handoff token for a session

Creates an anonymous session shell with no user and no factors (`state: building`). This is optional — an `auth_attempt` will create a session implicitly if none is provided. Use this explicitly when you want to: - Pre-allocate a `session_id` before the user is known, so device/telemetry signals can be correlated with the eventual authenticated session from the start. - Track anonymous state (bot detection, device fingerprint) that survives until authentication. Creating a session is an app-plane operation on the project credential (`session.write`). The returned `session_token` is a session credential for the end-user client, not a management scope: it is delivered as the `__nextgen_session` cookie and authorises the self-service operations `GET /sessions/me` and `DELETE /sessions/me` (`nextgenSession` scheme). The by-id operations `GET /sessions/{session_id}` and `DELETE /sessions/{session_id}` are operator endpoints and require `session.read` / `session.delete` instead. The `session_token` is superseded when a handoff exchange completes — clients must replace it at that point. Anonymous sessions expire aggressively (10-minute TTL). The TTL resets to the configured full session TTL when the first authentication factor is written via a completing `auth_attempt`.