fix: enable URL tables on the shared session

[emecii]

Which issue does this PR close?

Closes #1708.

Rationale for this change

enable_url_table() currently derives a different session. Subsequent SQL configuration changes diverge between handles, and FFI providers holding weak references can lose their original session when its handle is dropped.

What changes are included in this PR?

Install the dynamic catalog on the existing session state and return another handle to the same context and codecs. Check and install under one state write lock; bind the factory's weak session store before exposing the catalog. Repeated calls do not nest wrappers. Updating just the catalog list also preserves configuration, registrations and session identity instead of rebuilding state with builder defaults.

Python tests cover aliases, discarded return values, configuration and registrations in both directions, repeated calls and concurrent callers. The real FFI example tests exercise provider lifetimes after garbage collection. Update the API documentation, upgrade guide and FFI guidance.

Rebase resolution (2026-09-10): rebased the single PR commit onto 7022baae (#1679). Kept the Rust and regression-test behavior unchanged, combined the adjacent session-identity wording added by #1679, and moved the former docs/source/contributor-guide/ffi.md edits into its new canonical replacements: ffi-internals.md for allocation invariants and extension-guide/sessions.md for user-facing lifetime behavior. The deleted guide was not restored.

Validation after the rebase:

• Full Python suite: 1,441 passed, eight skipped.
• Real FFI examples: 108 passed (55 provider tests and 53 query-planner tests); the two focused URL-table provider-lifetime cases pass.
• Focused shared-session/concurrency tests: three passed; the enable_url_table doctest passes.
• Ruff, Ruff format, nightly Rust formatting, all-target/all-feature Clippy with warnings denied, codespell, and lockfile validation pass.
• The aggregate pre-commit invocation cannot start its Docker-only actionlint hook because Docker is absent; this PR changes no workflow files. Full Sphinx, free-threaded Python and other OS builds were not run locally.
• GitHub reports the rebased head mergeable. CI, Dev and CodeQL runs were created but await Apache approval to run workflows from this fork (action_required, zero jobs).

Implemented and checked with OpenAI Codex (GPT-6), recorded in the Generated-by trailer. No human review is being attested.

Are there any user-facing changes?

Yes: enabling URL tables now affects the receiver and every handle sharing its session, even when the return value is discarded. The returned Python wrapper is still a new wrapper, but it no longer owns a separate session. The upgrade guide documents this behavior change.

Opening as a draft for review of the shared-session API change. The api change label applies.