Session service

Hotovo

Login flow potrebuje session management. Session service (zavislost na Db) expose create/findByCookie/revoke/revokeAllForUser. Session ID = 32B random bytes base64url, default TTL 30 dni, findByCookie kontroluje expiry + maze expired session + touchuje lastUsedAt. K tomu cookie helpers (serialize/clear/parse) pro Run 01-03.