stop storing guest passwords, mint sessions server side

The old flow encrypted the guest password on disk next to its own key,
then sent it to the guest in the bootstrap HTML anyway. Now redemption
mints the session with ISessionManager.AuthenticateDirect and the page
only ever carries the session token. The guest account still gets a
random password nobody knows, so blank login stays impossible, but no
password is stored or sent anywhere anymore. Cleanup now defaults to
every 30 minutes instead of daily at 4am so expired guests die fast.

README.md

@@ -84,6 +84,13 @@ up the link. So:
 6. the real access boundary is the server-side tag policy; the web-client
    lockdown is convenience on top of it
 
+The same applies to the guest's login. The plugin mints the guest session itself
+on the server, using Jellyfin's own session manager. No password is ever stored
+anywhere, not even encrypted, and no password ever appears in the page sent to
+the guest. The only thing the guest's browser receives is a session token
+scoped to that one guest account, and that token dies the moment the guest
+account is cleaned up.
+
 ## Configuration
 
 All of these live on the plugin's dashboard page: