You can not use the Session that this establishes indefinitely. At some point the Session ID that it contains will become invalid. This could be due to inactivity, or it could be due to the session being specifically ended, such as the same user logging out or the Sessions being deleted.
You can use it from multiple threads. Note that there is a Concurrent Request limit for long running requests. See API Requests Limits
Try to avoid creating a new Session for each request. Instead get one Session, then use that as much as you can. But always be prepared for a request to come back with an invalid session id response.
In my case I've put a wrapper around the API to handle the invalid sessions when they occur. In this cases, if I have the credentials available, I attempt to reestablish the session and then carry on with the original operation.