Sessions previously used a hardcoded in-memory store, which is per-process
and unusable across replicas. Select the backend via [http.session_store]:

- memory (default) — zero-config; now warns on a non-loopback bind
- postgres (session-postgres feature) — reuses the configured [database]
  pool, auto-creates the session table, and runs a background expiry sweep
  that aborts on shutdown
- redis (session-redis feature) — fred pool from the URL, relying on Redis
  key expiry

`FluentRouter::with_session_store` accepts any tower_sessions::SessionStore
for backends not built in. `setup_session_handling` is now async + fallible.

The official tower-sessions-sqlx-store / -redis-store crates pin older,
mutually-incompatible tower-sessions-core versions, so both backends are
hand-rolled against tower-sessions 0.15's SessionStore trait (MessagePack
record serialization) in src/fluent/session_store.rs. Drops the unused
`ruts` dependency and re-gates the session unit test from `postgres` to
`session`.

Adds testcontainer round-trip tests proving a session persists across two
independent router instances sharing the store (the multi-replica case);
they require Docker.