Clarify session expiration behavior in API and Python SDK

What would you like to be added:

Clarify and align session expiration behavior across the Router, Workload Manager API, CRDs, and Python SDK.

A client may continue using x-agentcube-session-id after the corresponding sandbox has been reclaimed. The Router then returns HTTP 404, but the response does not provide a stable machine-readable error code. The Python SDK also propagates it as a generic HTTP exception without invalidating the stale session ID.

As a result, clients may repeatedly send an expired session ID and remain in a permanent 404 loop.

Session lifetime configuration is also inconsistent:

• sessionTimeout controls idle expiration.
• maxSessionDuration controls the hard lifetime limit.
• The Python SDK exposes ttl, but the current create-session API does not apply it.
• SDK timeout controls HTTP request timeout and is unrelated to session lifetime.

The expected behavior should be:

1. Return a stable error such as SESSION_NOT_FOUND when the Router cannot resolve a supplied session ID.
2. Keep this distinguishable from a 404 returned by the application inside the sandbox.
3. Let the Python SDK expose a specific session-not-found error and stop treating the stale session ID as valid.
4. Define whether request-level ttl is supported. If supported, enforce it under the CRD maximum lifetime policy; otherwise remove or reject it explicitly instead of silently ignoring it.
5. Document that clients must discard an expired session ID and explicitly create a new session if their application wants to continue.

Why is this needed:

Session reuse is part of the public AgentCube API, but expiration behavior is not currently defined well enough for official or third-party SDKs.

A consistent error and lifetime contract prevents clients from repeatedly using stale session IDs and makes session behavior predictable.