fix: correct code examples against Nova/Kura source

[Taure]

Summary

• JSON API controllers: use json key (not params) for decoded JSON bodies — nova_request_plugin puts JSON into json, params is for URL-encoded form data
• Login session flow: pass Req1 to redirect so session cookie is actually sent; use public nova_session:set/3 API instead of internal nova_session_ets:set_value/3
• plugin_info/0: return maps (not tuples) per the nova_plugin behaviour — fixed in 3 plugin examples and the cheat sheet
• sendfile tuple: corrected to {sendfile, StatusCode, Headers, {Offset, Length, Path}, MimeType}
• nova_request_plugin options: replaced non-existent read_body with parse_qs
• utc_datetime: maps to TIMESTAMPTZ (not TIMESTAMP) — fixed in schemas-migrations and cheat sheet
• Erlang version: updated from 26 to 27 to match OTP requirement
• Custom handler callback: corrected signature to fun(ReturnTuple, CallbackFun, Req) -> {ok, Req2}
• Security handler docs: added {redirect, Path} and {false, StatusCode, Headers, Body} return options

Test plan

• Verify each modified code example compiles or is consistent within its chapter
• Cross-reference changes against Nova, Kura, and rebar3_nova source

🤖 Generated with Claude Code