Builds the session middleware.

Registered by the plugin at priority 260: after security headers (250) so a rejected request never loads a session, and before authentication (300) so an auth strategy can read one.

The commit runs after next() returns. That works even though the handler has already called a terminal response method, because the kernel's response builder appends headers without consulting whether it ended, and hands the adapter its live Headers rather than a clone — cloning would collapse repeated Set-Cookie values into one comma-joined header.

A request that throws is deliberately not committed: the error handler is about to replace the response, and persisting a half-applied mutation from a failed request is worse than dropping it.

Tenant binding (default on): when a tenant is resolved for the request, the session is sealed with that tenant id before it commits, and a later request that presents a session bound to a different tenant is refused with 403 before the handler runs. When either the session or the request carries no tenant, nothing is compared, so an application without tenancy is inert.