fix: enable URL tables on the shared session

[emecii]

Which issue does this PR close?

Closes #1708.

Rationale for this change

enable_url_table() currently derives a different session. Subsequent SQL configuration changes diverge between handles, and FFI providers holding weak references can lose their original session when its handle is dropped.

What changes are included in this PR?

Install the dynamic catalog on the existing session state and return another handle to the same context and codecs. Check and install under one state write lock; bind the factory's weak session store before exposing the catalog. Repeated calls do not nest wrappers. Updating just the catalog list also preserves configuration, registrations and session identity instead of rebuilding state with builder defaults.

Python tests cover aliases, discarded return values, configuration and registrations in both directions, repeated calls and concurrent callers. The real FFI example tests exercise provider lifetimes after garbage collection. Update the API documentation, upgrade guide and FFI guidance.

Validation:

• Full Python suite: 1,391 passed, eight skipped; real FFI examples: 86 passed.
• Independent context/FFI rerun: 177 passed, two skipped. New shared-session and lifetime regressions fail on the original source.
• Changed-file pre-commit passes, including Rust formatting and all-target/all-feature Clippy. The full invocation could not run its Docker actionlint hook because Docker is absent; the matching native actionlint 1.7.12 passes against all workflows. Other full-run hooks passed.
• Full Sphinx build, free-threaded Python and other OS builds were not run locally.

Implemented and checked with OpenAI Codex (GPT-6), recorded in the Generated-by trailer. No human review is being attested. PR #1679 edits nearby context/FFI code and may require rebasing if it lands first.

Are there any user-facing changes?

Yes: enabling URL tables now affects the receiver and every handle sharing its session, even when the return value is discarded. The returned Python wrapper is still a new wrapper, but it no longer owns a separate session. The upgrade guide documents this behavior change.

Opening as a draft for review of the shared-session API change. The api change label applies.