Caffxine

Yes and yes. Choosing your platform type is done in the LoginSession constructor, which is provided by steam-session.
Correct. It pretends to be a real Steam client, connects to a CM the same way a Steam client does, and sends and receives the same messages a real Steam client does.

Only steamLoginSecure. sessionid is merely a CSRF token and can be any value.
Yes. A valid refresh token can be used to authenticate as long as it hasn't expired. It's worth noting that refresh tokens are specific to the platform for which they were generated; only a token generated for EAuthTokenPlatformType.SteamClient can be used to authenticate as a Steam client, and only a token generated for EAuthTokenPlatformType.MobileApp can be used for mobile-app-only requests, such as enabling or disabling 2FA. At present, refresh tokens for all platform types can be used to get web cookies, even though the Steam client doesn't get cookies the same way as the mobile app and web browsers.
It makes the same requests that the official Steam client, mobile app, and web apps use to authenticate users. There's a WebAPI interface for this, although it's not really meant for public consumption the way I'm using it. The Steam client makes the same requests, but they go through a CM (connection manager, the same server all other Steam client communication goes through).
If you're curious, you could hit F12 to open your browser console, switch to the network tab, then sign into steamcommunity.com. You won't see a tremendous amount of useful info though, since the requests are protobuf-encoded.

It's true that access tokens and refresh tokens are commonly used in OAuth, but this isn't OAuth. It just uses some of the same terminology. And yes, refresh tokens can be used for ~200 days until they expire. Refresh tokens are the tokens used by the Steam client when you select "remember my password", and by the mobile app to keep you logged in. A refresh token also gets set in your browser cookies to renew your web session when necessary.
There is a mechanism for renewing refresh tokens, which is seemingly used by the Steam client and by the mobile app. I'm working on adding support for refresh token renewal to steam-session.

Yes, you can use steam-session to get a refresh token; it supports using device confirmations to approve a login.
Your SteamUser client will stay logged on as long as it can stay connected to Steam. If it gets disconnected, it'll use the same refresh token that it used initially to log back in.

Why is my Steam inventory out-of-date?
 
Before we delve into Steam's inventory cache, first it helps to know how the economy server works.
 
When you request a user's Steam inventory, your request goes to the Steam economy server. If the economy server has that inventory in its cache, it returns the cached version. If not, it requests the inventory from the game's item server, caches the result that's returned, and then sends it back to you.
 
This cache does not automatically expire (in most circumstances). However, there are a few actions that can cause an inventory cache for a particular game to expire:
Launching the game via Steam Quitting the game via Steam Accepting a trade offer (or having a sent trade offer accepted) which includes items from the game Accepting a real-time trade request, or having a real-time trade request which you sent be accepted* Publishers can do it at their discretion * if a real-time trading session is opened for your account, then all games' inventory caches will be invalidated for your account.
 
I believe it's also supposed to be possible for Steamworks developers to tell the cache to expire at a certain date and time, but I don't believe it works currently.
 
The Steam inventory cache is what causes your inventory to not appear up-to-date, especially if you craft/receive a new item while the game is running. The easiest way to invalidate the cache in order to get fresh data is to open a real-time trading session.