docs(session): the idle timeout counts requests; example at 15 minutes

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>

README.md

@@ -177,9 +177,9 @@ token validities, and the `authentik.session_policy` health check reports any di
 
 ```java
 AuthentikSessionPolicy policy = new AuthentikSessionPolicy()
-   .withIdleTimeoutSeconds(3600)        // ends after an hour without a request
+   .withIdleTimeoutSeconds(900)         // ends after 15 minutes without a request
    .withAbsoluteMaximumSeconds(43200)   // ends twelve hours after sign-in, however busy
-   .withAccessTokenSeconds(600);        // default; how often an active session is renewed
+   .withAccessTokenSeconds(300);        // how often an active session is renewed (default 600)
 
 policy.applyTo(oauth2MetaData);         // sets maxSessionLifetimeSeconds; needs refresh tokens and offline_access
 config.withAppClientId("my-app").withSessionPolicy(policy);
@@ -196,6 +196,9 @@ config.withAppClientId("my-app").withSessionPolicy(policy);
   `offline_access` scope. `applyTo` and the config validation refuse an instance without the last two.
 - Precision is one access token: a session ends after between `idle - accessToken` and `idle` without
   a request, and at most `absoluteMaximum + accessToken` after sign-in.
+- This idle timeout counts requests, not user actions, so by itself it is not an automatic logoff after user
+  inactivity (HIPAA 164.312(a)(2)(iii), HITRUST session time-out): the host needs QQQ core's user inactivity
+  timeout for that, and this refresh-token validity is then the outer bound.
 - Any request counts as use. A page that polls or a device that sends heartbeats is not idle; only the
   absolute maximum ends such a session.
 - Numbers that cannot be enforced are configuration errors: `accessTokenSeconds` under 120, an idle