Promotes the optional @method to a required method, so User no longer needs method_exists() to call it. BC break: existing IdentityHandler implementations must now declare getGuestIdentity().

Identity class must exist as an alias in order to read it from session

Since nette/http 3.4 SessionSection::setExpiration() parses its argument via
Helpers::expirationToSeconds(), where a bare numeric string is taken as a
relative number of seconds and an empty string throws. Passing the absolute
timestamp as (string) therefore broke: a null expiration produced '' and threw,
and a real timestamp triggered the absolute-timestamp deprecation. Pass null
when unset and an '@'-prefixed timestamp otherwise, which is parsed as an
absolute, timezone-independent time.

Implementation handles tree mutations during listener execution:
- Listeners can modify tree (remove self, siblings, parent)
- Validity check before processing children
- Deduplication prevents calling same listener twice
- Reentry guard prevents infinite loops

0 historically meant a session cookie; null now expresses that explicitly.
0 is still accepted for BC but emits a deprecation notice.