Dev server with in-memory sessions: restarts look like 'session expired' and leftover test sessions hold per-host reader caps

Two self-inflicted problems while showing a local web app (Node, in-memory session map, each session starts a remote helper process over ssh) to its user:

1. Restarting the server to pick up a config change dropped every session. The user's next request got 'This session has expired', which was misleading. Fixes: - word the 404 as 'the server was restarted or the session sat idle too long; reload'; - don't restart while the user is connected: check lsof -a -p <pid> -iTCP -sTCP:ESTABLISHED, and note that -a is needed; - or persist sessions, or hot-reload config.

2. A per-entry maxHelpers: 1 cap counted every helper on the same ssh host, not just that entry's. My curl smoke-test session, left open, then blocked the user ('reader in use'). Fixes: - close smoke-test sessions right away (DELETE /api/sessions/<id>); - scope a cap to the resource it protects; - don't copy a memory-budget cap from one host's config entry to another host's.

General: after any smoke test against a server someone is actively using, clean up what you started before handing it back.