feat(session): add automatic inactive session cleanup scheduler

[singhanurag0317-bit]

Feature: Automatic Inactive Session Cleanup and Validation

Closes #1661

Problem

• Inactive sessions stayed valid in the database until absolute expiration regardless of user inactivity.
• Mongoose logged a duplicate schema index warning on Session.expiresAt.

Change

• New backend/src/services/sessionCleaner.service.js (SessionCleaner) deactivates stale sessions based on the updatedAt timestamp:
  • execute() marks isValid: false for sessions where updatedAt < now - SESSION_INACTIVITY_LIMIT_MS (default 30 days, configurable via env).
  • startScheduler() schedules the job with node-cron (default daily at 02:00, overridable via SESSION_CLEANUP_CRON).
• Wired SessionCleaner.startScheduler() into backend/server.js next to the existing CleanupTask scheduler.
• Added node-cron to backend/package.json (this also fixes the latent broken node-cron import in src/config/cron.js, which previously would throw since the package was never installed).
• Removed the duplicate index: true on Session.expiresAt in backend/src/models/session.model.js; the explicit TTL index (sessionSchema.index({ expiresAt: 1 }, { expireAfterSeconds: 0 })) remains the single source of truth, eliminating the Mongoose duplicate-index warning.

Tests

New backend/src/services/__tests__/sessionCleaner.test.js:

• Deactivates sessions older than the inactivity limit with { isValid: true, updatedAt: { $lt: <cutoff> } }.
• Cutoff computed from the configured 30-day inactivity limit.
• Returns 0 without throwing when the database call fails.

Full backend suite: 9 suites / 23 tests passing.

[vercel]

@singhanurag0317-bit is attempting to deploy a commit to the souma9830's projects Team on Vercel.

A member of the Team first needs to authorize it.