Probably better suited for the mailing list. Also have a look at the paper for some of these topics.
When/how do sessions expire?
The default expiration for temporary sessions in the server implementation is 24h.
Can session expire time be configured on the server?
You could edit the /usr/lib/opencpu/scripts/cleanocpu.sh
script, which get triggered through /etc/cron.d/opencpu
. But if you want persistence it is usually better to store things in a database (RMySQL, mongolite, etc) or in a package on the server, or in the client.
Can session expire time be changed at runtime?
No, expiration of resources is up to the server.
Are sessions saved on-disk or in-memory?
The current implementation saves on disk (with a bit of in-memory cache), but the API is agnostic.
Do sessions work with the nginx opencpu proxy?
Yes, they are no different than anything else on the server.