refactor(server): keep session state crate-private

`Session` and the token lookup that returns it were public, which published
internal session state before there is a consumer for it. The next slices are
all but certain to add and restructure fields here — receive counts and
windows, sequence tracking, activity and expiry state — and nothing outside
the crate needs a session yet.

Make `Session` and `ServerCore::session` crate-private. `session_count`
stays public: how much session state the server holds against its bound is a
sensible stable observable, unlike the sessions themselves.

The endpoint accessors have no production reader until echo and close
processing arrive, since a session's endpoint has to be captured at open time
and is not recoverable later. They are marked accordingly rather than left to
warn.

crates/irtt-server/src/core.rs

@@ -68,6 +68,10 @@ impl ServerCore {
     }
 
     /// The number of live sessions.
+    ///
+    /// This is the observable a caller genuinely needs — how much session state
+    /// the server is holding against its bound. The sessions themselves stay
+    /// crate-private until their shape settles.
     #[must_use]
     pub fn session_count(&self) -> usize {
         self.sessions.len()
@@ -78,8 +82,11 @@ impl ServerCore {
     /// This is a lookup by token alone and is therefore *not* an admission
     /// check: a request is bound to a session only when the token matches and
     /// it arrived from the session's exact endpoint.
-    #[must_use]
-    pub fn session(&self, token: u64) -> Option<&Session> {
+    //
+    // Called only by tests until echo and close processing arrive, which is
+    // what a token lookup is for.
+    #[allow(dead_code)]
+    pub(crate) fn session(&self, token: u64) -> Option<&Session> {
         self.sessions.get(&token)
     }