refactor(server): keep session state crate-private

`Session` and the token lookup that returns it were public, which published
internal session state before there is a consumer for it. The next slices are
all but certain to add and restructure fields here — receive counts and
windows, sequence tracking, activity and expiry state — and nothing outside
the crate needs a session yet.

Make `Session` and `ServerCore::session` crate-private. `session_count`
stays public: how much session state the server holds against its bound is a
sensible stable observable, unlike the sessions themselves.

The endpoint accessors have no production reader until echo and close
processing arrive, since a session's endpoint has to be captured at open time
and is not recoverable later. They are marked accordingly rather than left to
warn.

crates/irtt-server/src/lib.rs

@@ -50,4 +50,3 @@ mod tests;
 pub use config::{ServerConfig, DEFAULT_MAX_SESSIONS};
 pub use core::ServerCore;
 pub use error::ServerError;
-pub use session::Session;