Warn users before idle checks reclaim their sessions

## Request

Sessions reclaimed by idle checks are terminated with no prior notice to their owner. Users lose in-progress work and get no chance to extend the session or wrap up what they were doing.

We would like an advance warning — "this session will be reclaimed in N minutes" — delivered before the reclamation actually happens.

## Desired shape

Ideally this rides on the existing notification feature in the Control Panel, so an admin can configure it as a notification rule like any other event, rather than as a one-off mechanism.

## Notes for whoever picks this up

- `NotificationRuleType` has no idle-related type today. Of its four values only `artifact.download.completed` and `endpoint.lifecycle.changed` are actually emitted; `session.started` / `session.terminated` are defined but no code publishes them.
- Notification channels carry a fixed recipient (`EmailMessage.to_emails`, or a fixed webhook URL) decided when the channel is created, so delivering to the session owner is not expressible today.
- `session_idle_checks.expire_at` is already persisted, so "how long until reclamation" is available.

JIRA Issue: BA-7274

Start by reading NotificationRuleType and the existing notification channel recipient handling, then trace how session_idle_checks uses the persisted expire_at value. Compare the emitted notification types with the idle-check lifecycle and determine what would be required for a configurable warning delivered to the session owner before reclamation.

Written by the indexing model from the issue text.