pub fn validate_session_id(session_id: &str) -> Result<()>
Validate session ID format.
Allowed: alphanumerics, hyphens, underscores. 1–128 characters.