Backend: Enforce session timeout validation

[ONEONUORA]

Problem

Sessions are created but timeout isn't checked.

Impact

• Indefinite session validity
• Security vulnerability
• Resource leakage

Solution

Implement session timeout validation and enforcement.

Files to Modify

• backend/src/session.rs

Priority

High - Security