Add websocket session support to kaya-session

- kaya-core: WebSocket ABC gains session attribute and accept(headers=...)
- kaya-core: AsgiWebSocket injects headers into websocket.accept message
- kaya-rsgi: RsgiWebSocket accepts headers param (ignored — Granian's
  accept() takes no args)
- kaya-session: SessionWebSocket wrapper exposes ws.session and injects
  Set-Cookie on accept()
- kaya-session: SessionMixin registers before/after websocket hooks;
  session loaded at connect, persisted on close if modified
- 10 new WV session tests covering read, persist, handshake cookie,
  regenerate, invalidate, isolation
- Example and README updated

packages/kaya-session/README.md

@@ -27,6 +27,27 @@ session.
 `SessionMixin` is a `KayaMixin`, so the app stays a `KayaApp` and both ASGI and
 RSGI keep working.
 
+## WebSocket sessions
+
+The same session is available in websocket handlers as `ws.session`:
+
+```python
+@app.websocket('/ws/visits')
+async def ws_visits(ws: WebSocket):
+    visits = ws.session.get('visits', 0) + 1
+    ws.session['visits'] = visits
+    await ws.accept()
+    await ws.send_text(f'visits: {visits}')
+```
+
+The session is loaded from the cookie when the connection is opened and
+persisted when the connection closes, if it was modified. The session cookie
+can only be set or refreshed on the handshake response, so mutate the session
+*before* calling `ws.accept()` if you want the cookie delivered with the
+handshake. Handshake cookies require ASGI spec version 2.1+; RSGI websocket
+handshakes cannot carry response headers, so on RSGI the session is loaded and
+persisted but the cookie is only set or refreshed by HTTP responses.
+
 ## Session expiry
 
 The cookie sent to the browser has a `Max-Age` (default 14 days), but that is
@@ -50,6 +71,8 @@ attribute) entirely.
 - `SessionMixin`: composable Kaya mixin managing session cookies and persistence
 - Session ID regeneration (`session.regenerate_id()`) and invalidation
   (`session.invalidate()`) for authentication layers
+- WebSocket support: the session is exposed as `ws.session` in websocket
+  handlers, loaded at connect time and persisted on close
 
 ## Notes