fix: serialize AutoSession creation with Session.Close

[linkdata]

Summary

Fixes #249.

• Creates and associates an AutoSession with its initiating Request before publishing it in the session registry.
• Commits a session cookie only while the exact Session remains registered and live, after calling the reentrant ResponseWriter.Header outside all core locks.
• Shares that cookie commit with NewSession and SessionMiddleware so manual creation cannot emit a stale live cookie after a close winner.
• Documents association, nil handling, concurrent-close behavior, and replacement-random-reader panic behavior.

Concurrency model

AutoSession creation follows the established Jaws -> Request -> Session lock order. Both sides of the Request/Session association are established before registry insertion, so Sessions never exposes a half-associated AutoSession.

Cookie publication calls ResponseWriter.Header with no internal lock held, then holds Jaws and Session read locks through the concrete response/request header mutations. If cookie publication wins, a later Close sees and detaches the associated Request and queues one reload. If Close wins, no live response or request cookie is installed.

Creation remains in the 101 Switching Protocols hook, preserving the accepted-handshake-only behavior from #139.

Tests

• TestWS_AutoSessionCloseAtPublication uses a real WebSocket and an unwrap-capable, reentrant ResponseWriter to close the Session at publication. It verifies detachment, empty Session membership, registry removal, no live cookie, and exactly one pre-subscription reload.
• TestSessionMiddleware_CloseDuringResponseHeader covers the same cookie winner semantics for middleware-created Sessions.
• TestSession_AddCookieRejectsUnavailableSession independently pins the exact-registry and liveness guards.
• Nil request/writer tests preserve the documented NewSession behavior, and an injected-reader regression proves session allocation releases the Jaws lock on panic.
• Existing successful, existing-session, rejected-origin, and malformed-handshake AutoSession tests remain green.

Verification

• go generate ./...
• gofmt -l .
• go vet ./...
• staticcheck ./...
• golangci-lint run
• gosec ./...
• JAWS_REQUIRE_NODE=1 go test -race ./...
• JAWS_REQUIRE_NODE=1 go test ./...
• go build ./...