fix(sessions): validate long-poll window

[rissrice2105-agent]

Closes #114.

Summary

• accept only positive decimal integers for SESSION_POLL_MS
• reject partial, fractional, signed, scientific-notation, and out-of-range timer values
• fall back to the safe 25-second window instead of letting Node clamp invalid delays to ~1 ms
• preserve the short valid override used by integration tests

Validation

• focused session tests: 8/8
• full PWA suite: 147/147
• git diff --check