docs/remote-access.md still says an expired session cannot be told apart from a wrong one (#985 follow-up) #1002

Follow-up to #985 / PR #1001, which was merged from eebc202 one commit before the docs fix landed.

The problem

docs/remote-access.md (the paragraph beginning "So a server configured with --external-host enforces a 12-hour session lifetime") still says the lifetime is "checked before the token so an expired session cannot be told apart from a wrong one by which refusal comes back".

Since #983 and #985 that is no longer exact. Two requests behave differently past the lifetime:

• A halt that carries the session cookie and the halt token is accepted (Remote session lifetime (#648) refuses HALT too: a keel serve --external-host console can't halt after 12h until restarted #983).
• A Pulse read: GET/HEAD /api/pulse with this session's cookie is still refused as expired, but the refusal carries the HALT control's inputs (Console: keep the HALT control on Pulse after the remote session lifetime expires (client half of #983) #985, KeelHandler._expired_pulse_halt).

The doc also never tells an operator on a tunnel that the console keeps its HALT past the lifetime. The code-side prose (server.py #648 comment, payload.halt_fallback, api.pulse_halt) was corrected in #1001; only this operator doc was missed. Found by the round-3 review of #1001 (review comment 4264193527).

The fix, already written

Commit 35bd873 on the (merged) branch fix/985-halt-after-lifetime rewrites that paragraph. It touches only docs/remote-access.md. The round-4 review checked each claim in it against keel/web/server.py and found them all true, and test_doc_links.py and test_web_prose_stays_true.py pass on it.

To land it: git cherry-pick 35bd873 onto a fresh branch from main, then open a PR.