Enforce 30-day session expiry with lazy cleanup

Sessions never expired server-side despite the 30-day cookie Max-Age;
repeat sign-ins orphaned rows. user_id now rejects tokens older than 30
days and deletes them on sight. Verified live: fresh 200, backdated 302
with row removed.

src/auth.rs

@@ -100,17 +100,32 @@ pub async fn user_id(pool: &SqlitePool, h: &HeaderMap) -> Option<String> {
     }
     let token = token?;
     tracing::debug!("session token={token}");
-    match sqlx::query_scalar::<_, String>("SELECT user_id FROM sessions WHERE token=?")
+    // Sessions live 30 days (matching the cookie Max-Age). Stale rows are
-        .bind(token)
+    // deleted on sight so repeat sign-ins don't orphan tokens forever.
-        .fetch_optional(pool)
+    let row: Option<(String, String)> =
-        .await
+        sqlx::query_as("SELECT user_id, created_at FROM sessions WHERE token=?")
-    {
+            .bind(token)
-        Ok(found) => {
+            .fetch_optional(pool)
-            tracing::debug!("session lookup -> {:?}", found);
+            .await
-            found
+            .unwrap_or(None);
+    match row {
+        Some((uid, created)) => {
+            let fresh = chrono::DateTime::parse_from_rfc3339(&created)
+                .map(|t| (chrono::Utc::now() - t.with_timezone(&chrono::Utc)).num_days() < 30)
+                .unwrap_or(false);
+            if !fresh {
+                sqlx::query("DELETE FROM sessions WHERE token=?")
+                    .bind(token)
+                    .execute(pool)
+                    .await
+                    .ok();
+                return None;
+            }
+            tracing::debug!("session lookup -> {:?}", uid);
+            Some(uid)
         }
-        Err(e) => {
+        None => {
-            tracing::error!("session lookup failed: {e}");
+            tracing::debug!("session lookup -> None");
             None
         }
     }