fix: reap expired sessions with a periodic background sweep

The sessions table only grew — find_active ignored expired rows but nothing
deleted them, so lapsed sessions accumulated indefinitely.

- repo::session::delete_expired: indexed DELETE (sessions_expires_idx) returning
  the reaped count.
- app::build spawns a detached hourly reaper (SESSION_GC_INTERVAL) that calls it,
  independent of crawler/analysis config.

Test: delete_expired_removes_only_lapsed_sessions.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/tests/repo_session.rs

@@ -0,0 +1,52 @@
+mod common;
+
+use chrono::{Duration, Utc};
+use sqlx::PgPool;
+
+use mangalord::repo;
+
+#[sqlx::test(migrations = "./migrations")]
+async fn delete_expired_removes_only_lapsed_sessions(pool: PgPool) {
+    let user = repo::user::create(&pool, "reaper-subject", "x").await.unwrap();
+
+    // One session already lapsed, one still valid.
+    let expired = repo::session::create(
+        &pool,
+        user.id,
+        b"expired-token-hash-00000000000000",
+        Utc::now() - Duration::hours(1),
+    )
+    .await
+    .unwrap();
+    let active = repo::session::create(
+        &pool,
+        user.id,
+        b"active-token-hash-000000000000000",
+        Utc::now() + Duration::hours(1),
+    )
+    .await
+    .unwrap();
+
+    let removed = repo::session::delete_expired(&pool).await.unwrap();
+    assert_eq!(removed, 1, "exactly the one lapsed session is reaped");
+
+    // The active session is untouched and still resolvable; the expired one is
+    // gone from the table entirely (find_active already ignored it, but now the
+    // row is reclaimed too).
+    assert!(
+        repo::session::find_active(&pool, b"active-token-hash-000000000000000")
+            .await
+            .unwrap()
+            .is_some(),
+        "active session survives the sweep"
+    );
+    let remaining: i64 = sqlx::query_scalar("SELECT count(*) FROM sessions")
+        .fetch_one(&pool)
+        .await
+        .unwrap();
+    assert_eq!(remaining, 1);
+
+    // Sweeping again is a no-op now that nothing is expired.
+    assert_eq!(repo::session::delete_expired(&pool).await.unwrap(), 0);
+    let _ = (expired, active);
+}