feat: periodically sweep expired auth sessions

auth_sessions rows were never deleted after expiry, only rejected
on read. Adds a background sweep (every 30 min) in the app lifespan,
plus a tested pure delete_expired_sessions() function.

backend/app/main.py

@@ -1,3 +1,5 @@
+import asyncio
+import contextlib
 from contextlib import asynccontextmanager
 from pathlib import Path
 
@@ -7,22 +9,49 @@ from fastapi.staticfiles import StaticFiles
 
 import app.models  # noqa: F401 — registers models on Base.metadata before create_all
 from app.config import settings
-from app.db import Base, engine
+from app.db import Base, async_session_maker, engine
 from app.routes.auth import router as auth_router
 from app.routes.codex import router as codex_router
 from app.routes.shop import router as shop_router
+from app.session_cleanup import delete_expired_sessions
 from app.ws import AUDIO_DIR
 from app.ws import router as ws_router
 
 FRONTEND_DIST = Path(__file__).resolve().parent.parent.parent / "frontend" / "dist"
 
+SESSION_CLEANUP_INTERVAL_SECONDS = 30 * 60
+
+
+async def _session_cleanup_loop() -> None:
+    """Periodically sweeps expired auth_sessions rows so the table doesn't
+    grow forever — get_current_user already rejects expired sessions on
+    read, this just deletes the rows themselves."""
+    try:
+        while True:
+            await asyncio.sleep(SESSION_CLEANUP_INTERVAL_SECONDS)
+            try:
+                async with async_session_maker() as db:
+                    await delete_expired_sessions(db)
+            except Exception:
+                # A transient DB hiccup shouldn't kill the sweep loop —
+                # just try again next interval.
+                pass
+    except asyncio.CancelledError:
+        pass
+
 
 @asynccontextmanager
 async def lifespan(app: FastAPI):
     AUDIO_DIR.mkdir(parents=True, exist_ok=True)
     async with engine.begin() as conn:
         await conn.run_sync(Base.metadata.create_all)
-    yield
+    cleanup_task = asyncio.create_task(_session_cleanup_loop())
+    try:
+        yield
+    finally:
+        cleanup_task.cancel()
+        with contextlib.suppress(asyncio.CancelledError):
+            await cleanup_task
 
 
 app = FastAPI(title="Quantumancy", lifespan=lifespan)