Google has all this answers, but is spread over a lot of different places and can be hard to find. To answer all 3 of your questions:
Do we have to generate new Session Tokens or can we reuse the same and the API will group them anyway within time-windows?
The session tokens cannot be reused from one session to the other.
Do we have to be aware of the lifespan of the Session Tokens?
The session begins when the user starts typing and ends when they select a place and you call the detail API. Once that happens you must generate a new session token for each new call to the autocomplete API.
Can the Session Tokens be any kind of string?
The Google Places API provides a class that you can use, but you don't have to. The class Google provides is called AutocompleteSessionToken it can be used liked this:
var token = new google.maps.places.AutocompleteSessionToken()
But you can also use your own string. See Google's recommendation
All this info is straight from the Google Docs, see below:
Place Autocomplete uses session tokens to group the query and selection phases of a user autocomplete search into a discrete session for billing purposes. The session begins when the user starts typing a query, and concludes when they select a place. Each session can have multiple queries, followed by one place selection. Once a session has concluded, the token is no longer valid; your app must generate a fresh token for each session. We recommend using session tokens for all autocomplete sessions. If the sessiontoken parameter is omitted, or if you reuse a session token, the session is charged as if no session token was provided (each request is billed separately).
Source: Google Documentation