Session Timeout Documentation Missing NIST SP 800-63B Deviation Justification and Internal Inconsistency

Bringing this to `asfquart` out of some triage on `tooling-trusted-releases`; the question is upstream so we consolidate discussion about whether to adopt this or another standard, or document our decisions.

Specifically, things like what should all our timeouts be, how does this line up with MFA, if a user logs out of an app does it invalidate their MFA, etc.

### Summary

Two documentation deficiencies exist in the session timeout configuration: (1) the NIST SP 800-63B deviation justification is absent, and (2) the hardcoded 7-day inactivity timeout can never fire under the default 72-hour absolute maximum, making it effectively dead code.

### Details

Both an inactivity timeout (`_SESSION_IDLE_TIMEOUT`, 7 days) and an absolute maximum lifetime (`MAX_SESSION_AGE`, documented default 72 hours) exist and are documented. However:

1. The documentation describes the timeout values but does not reference NIST SP 800-63B re-authentication requirements or justify the chosen values as a deviation.
2. The 7-day inactivity timeout is longer than the 72-hour absolute maximum, so the inactivity check can never fire under default configuration — making it effectively dead code.

**Attacker capability required:** None (documentation/analysis gap).
**Impact:** No direct C/I/A impact.

**Affected files:**
- `atr/sessions.py`
- `atr/docs/authentication-security.md`
- `atr/docs/asfquart-usage.md`

**ASVS:** 7.1.1 (L2)

### Remediation

Add a session risk-analysis note to the session-management documentation that:

- (a) States the concrete inactivity and absolute-lifetime values actually enforced by `Store.validate()`.
- (b) Documents the relationship between the hardcoded 7-day idle timeout and the configurable absolute maximum.
- (c) Records the justification for deviating from NIST SP 800-63B re-authentication intervals given the delegation of primary auth to the ASF IdP.

Consider making `_SESSION_IDLE_TIMEOUT` configurable so it cannot silently become dead code.

### Acceptance Criteria

- [ ] Fixed
- [ ] Test added — assert that `Store.validate()` correctly applies both timeout values and that the inactivity timeout is reachable under a configuration where it is shorter than the absolute maximum

### References

- ASVS 7.1.1
- Source report: `7.1.1.md`

Start with Store.validate() in atr/sessions.py, then read atr/docs/authentication-security.md and atr/docs/asfquart-usage.md to compare the enforced timeout values. Trace how the 7-day idle timeout relates to the configurable absolute maximum and the delegated ASF IdP authentication. Done means the documentation records the NIST deviation rationale and a test covers both timeout values, including a reachable inactivity timeout configuration.

Written by the indexing model from the issue text.