feat(session): add configurable max concurrent sessions with LRU evic…

[lamborghini21]

Summary

Closes #849 Adds a configurable limit on concurrent active sessions per user, with LRU eviction of the oldest session when the limit is exceeded. This prevents an attacker with a stolen credential from maintaining unlimited parallel sessions indefinitely.

Changes

• `src/session/session.service.ts`

  • Sessions per user are now tracked in a Redis Sorted Set keyed by `user:sessions:{userId}`, scored by `createdAt`.
  • After `createSession()` saves a new session, the sorted set is trimmed to the configured maximum, and any evicted session's Redis key is deleted so it can no longer be used for authentication.
  • The max session count is read from `ConfigService` via `MAX_SESSIONS_PER_USER`, defaulting to `5` when not set — no code changes needed to adjust the limit.

• `src/session/session.service.spec.ts`

  • Added a unit test covering eviction: creating session N+1 for a user beyond the configured max evicts the oldest session.

Acceptance Criteria

• Creating session N+1 evicts the oldest session
• Evicted session cannot be used for authentication
• Max session count is configurable without code changes (`MAX_SESSIONS_PER_USER` via `ConfigService`, default 5)

Testing

Ran the full spec file locally:

```
npx jest src/session/session.service.spec.ts --runInBand
```

24/24 tests passing, including the new eviction test. Also verified with `--detectOpenHandles` to rule out teardown/leak issues — no open handles reported.

Notes

• Only `session.service.ts` and its spec were touched, per the issue's impacted files list.
• `package-lock.json` changes from local dependency drift were excluded from this PR since they're unrelated to this feature." --base main --head fix/849-max-concurrent-sessions

[drips-wave]

@lamborghini21 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits