fix: reap expired sessions with a periodic background sweep

The sessions table only grew — find_active ignored expired rows but nothing
deleted them, so lapsed sessions accumulated indefinitely.

- repo::session::delete_expired: indexed DELETE (sessions_expires_idx) returning
  the reaped count.
- app::build spawns a detached hourly reaper (SESSION_GC_INTERVAL) that calls it,
  independent of crawler/analysis config.

Test: delete_expired_removes_only_lapsed_sessions.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/repo/session.rs

@@ -65,3 +65,15 @@ pub async fn delete_by_token_hash(pool: &PgPool, token_hash: &[u8]) -> AppResult
         .await?;
     Ok(())
 }
+
+/// Delete every session whose `expires_at` has passed, returning the number
+/// reaped. `find_active` already refuses expired sessions, so this only
+/// reclaims storage — running it on any schedule (or not at all) is safe.
+/// Backed by `sessions_expires_idx` (0002). Called by the periodic reaper in
+/// `app::build`.
+pub async fn delete_expired(pool: &PgPool) -> AppResult<u64> {
+    let result = sqlx::query("DELETE FROM sessions WHERE expires_at <= now()")
+        .execute(pool)
+        .await?;
+    Ok(result.rows_affected())
+}