Does the system enforce session inactivity timeouts (where the system automatically logs users off or terminates a user's session after a specified period of inactivity)?

Yes. However, some apps which are meant to be non-interactive will automatically refresh a session (for instance a graphic that is displayed on a non-user PC).
Additionally, some apps may request "offline access" to data. These apps are able to refresh access tokens without user interaction (typically apps that perform continuous monitoring of data). Apps that request offline access are clearly marked when the user signs in. An app's data source permissions can be revoked at any time.