Add expiredAt and completedAt to session response

Sessions now return expiredAt and completedAt timestamps alongside the existing createdAt. expiredAt is included when the session has expired; completedAt when it has been completed. Both are omitted otherwise.