docs: clarify that Session usually should be called - methods should not be used directly

Documentation based on clarification by Søren Løvborg:

Session is the factory/singleton manager, which tracks the current session (per
thread). To end the current session entirely and destroy the Session object, we
call remove on the manager (Session.remove()). (A new session will be created
on-demand.)

Session() returns the current session for the active thread (or creates a new
session, if there's none). commit is a method of the SQLAlchemy Session class,
thus called as Session().commit() ... it's a method call on the current Session
object, not the session factory/manager.

SQLAlchemy may have some hackery to allow Session.commit() to be called, and
the call automatically redirect to the actual Session object... but that's a
hack and should be avoided.

TL;DR: for remove, call it on Session; for everything else, call it on
Session().

docs/contributing.rst

@@ -182,7 +182,13 b' Notes on the SQLAlchemy session'
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
 Each HTTP request runs inside an independent SQLAlchemy session (as well
-as in an independent database transaction). Database model objects
+as in an independent database transaction). ``Session`` is the session manager
+and factory. ``Session()`` will create a new session on-demand or return the
+current session for the active thread. Many database operations are methods on
+such session instances - only ``Session.remove()`` should be called directly on
+the manager.
+
+Database model objects
 (almost) always belong to a particular SQLAlchemy session, which means
 that SQLAlchemy will ensure that they're kept in sync with the database
 (but also means that they cannot be shared across requests).