fix(qod): don't let a session that never started block the device

A create that fails ends up UNAVAILABLE with status_info NETWORK_TERMINATED, the same state as a network-terminated session. find_active_by_device treated it as still active for the 360 s cleanup window, so every new create for that device returned 409 for 6 minutes. That check now also requires started_at to be set, so only sessions that actually became AVAILABLE keep blocking the device.