POST /sessions no longer inserts a DB row. The Session is registered in an
in-memory _pending registry on PgSessionStore and only upserted on the first
save() (first user message / meaningful state change). Empty sessions that
never receive a message never reach the DB and vanish on server restart or
via the hourly pending sweep.

- pg_session_store: _pending dict + lock; create() registers, get() checks
  _pending first, save() upserts the sessions row (INSERT ... ON CONFLICT)
  and pops _pending so the session_messages FK is satisfied; sweep_pending()
  drops abandoned entries; pending_sweep_loop() background task.
- main.py: start/cancel pending_sweep_loop in lifespan.
- tests: 7 new tests for create/get/save/list/sweep semantics; updated
  existing save() test comments for the upsert.