1## 1. Session storage23- [x] 1.1 Add nullable `absolute_expires_at` to `sessions` (migration 0042)4- [x] 1.2 Backfill `absolute_expires_at = now() + interval '7 days'` in batches of 5,00056## 2. Expiry and revocation78- [x] 2.1 Enforce 12h idle timeout in session middleware9- [ ] 2.2 Enforce 7-day absolute lifetime (treat NULL as `created_at + 7d`)10 - [x] Unit test: session used 1h ago but created 8 days ago is rejected11 - [ ] Unit test: NULL `absolute_expires_at` falls back to `created_at`12- [ ] 2.3 Add `GET /account/sessions` and `DELETE /account/sessions/:id`13- [ ] 2.4 Build Active sessions page with "This device" label1415## 3. Remove remember-me1617- [X] 3.1 Remove "Remember me" checkbox from login form18- [ ] 3.2 Stop reading `remember_me` in session creation1920## 4. Rename and docs2122- [ ] 4.1 Rename `password_login` metrics and log fields to `password_auth`23- [ ] 4.2 Update security docs and support macro for shorter sessions