`session.Manager` misuses `context.Background()` and `nil` instead of propagating request context

Description

The session.Manager in server/web/session/session.go does not properly propagate context.Context. Almost every call to the Provider interface methods uses context.Background() or even passes nil, even when a valid request context (r.Context()) is readily available.

This defeats the entire purpose of having context.Context in the Provider and Store interfaces.

Problems

1. context.Background() instead of r.Context(): Methods like SessionStart, SessionDestroy, and SessionRegenerateID all have access to *http.Request but hardcode context.Background() when calling provider methods.

2. nil context: GC() and GetActiveSession() pass nil directly to provider methods, which will cause a panic if any provider implementation actually uses the context.

3. Missing context parameter: GetSessionStore(sid string) does not accept a context.Context at all.

Impact

• No request cancellation propagation — session operations (especially with remote backends like Redis) continue even after the client disconnects.
• Distributed tracing (e.g., OpenTelemetry) breaks because the trace chain is lost.
• nil context is a latent crash risk for any provider that uses the context.