docs: document HERDR_SESSION and the active_sessions.json state file

Note that it's a boot-time default a client can override at runtime,
and that the override persists under HERDR_LOG_DIR.