Two low-severity findings from the #47 review round (#52):
1. validSessions was a bare Set<string> — the 7-day cookie maxAge was a
browser-side hint only, so a token stayed valid forever server-side
until an explicit /admin/logout or a process restart. Now a
Map<token, expiry>, checked and pruned lazily on lookup, with an
opportunistic full sweep on login so an abandoned session doesn't
linger in memory indefinitely either.
2. /admin/login on a misconfigured deploy (ADMIN_PASSWORD unset)
returned the literal string "ADMIN_PASSWORD not set" to an
unauthenticated caller, bypassing the generic-500 masking every other
500 in the app goes through (see index.ts's error handler) — minor
recon value for anyone probing. Now logged server-side and masked
like any other internal error.
fd04564602