feat: T27 AuthService DB session persistence - replace in-memory Map with SQLite sessions table

backend/src/auth/AuthService.ts

@@ -3,7 +3,7 @@
  */
 import bcrypt from 'bcrypt';
 import { randomUUID } from 'crypto';
-import type { DatabaseInterface, DBUser } from '../database/DatabaseInterface.js';
+import type { DatabaseInterface, DBUser, DBSession } from '../database/DatabaseInterface.js';
 
 const SALT_ROUNDS = 10;
 const SESSION_TTL_MS = 24 * 60 * 60 * 1000; // 24 hours
@@ -20,8 +20,6 @@ export interface AuthResult {
 }
 
 export class AuthService {
-  private sessions = new Map<string, Session>();
-
   constructor(private db: DatabaseInterface) {}
 
   async register(email: string, password: string, name: string, role: string = 'planer'): Promise<AuthResult> {
@@ -64,27 +62,27 @@ export class AuthService {
 
   createSession(userId: string): Session {
     const token = randomUUID();
-    const session: Session = {
-      token,
-      userId,
-      expiresAt: Date.now() + SESSION_TTL_MS,
-    };
-    this.sessions.set(token, session);
-    return session;
+    const expiresAt = Date.now() + SESSION_TTL_MS;
+    this.db.createSession({ token, user_id: userId, expires_at: expiresAt });
+    return { token, userId, expiresAt };
   }
 
   validateSession(token: string): Session | null {
-    const session = this.sessions.get(token);
-    if (!session) return null;
-    if (Date.now() > session.expiresAt) {
-      this.sessions.delete(token);
+    const dbSession = this.db.getSession(token);
+    if (!dbSession) return null;
+    if (Date.now() > dbSession.expires_at) {
+      this.db.deleteSession(token);
       return null;
     }
-    return session;
+    return {
+      token: dbSession.token,
+      userId: dbSession.user_id,
+      expiresAt: dbSession.expires_at,
+    };
   }
 
   destroySession(token: string): void {
-    this.sessions.delete(token);
+    this.db.deleteSession(token);
   }
 
   getUserFromSession(token: string): DBUser | null {