Feat/session compaction job

[Anadudev]

Closes #495

Description

This PR implements a nightly session storage compaction job to clean up revoked and expired session rows that accumulate indefinitely and bloat backups. It deletes these rows if they are older than the configured retention window (default 30 days) and subsequently vacuums the table.

Changes

• Configuration: Added SESSION_RETENTION_DAYS (default 30) to env.ts.
• Repository: Extended SessionRepository with purgeOlderThan(cutoffDate, batchSize), vacuumSessions(), and getOldestCompactedSessionDate(cutoffDate).
  • purgeOlderThan uses bounded batch deletion (LIMIT $2) to avoid long-held locks during bulk removal.
• Service: Added SessionCompactionService which schedules the job using the existing setInterval scheduler harness.
  • Deletes expired/revoked rows in batches of 1000.
  • Emits metrics: session.compaction.rows for total deleted, and session.compaction.retention_lag_days for lag from the retention boundary.
• Wiring: Instantiated SessionCompactionService in src/index.ts alongside AuditPurgeService and integrated it into the application lifecycle.
• Tests: Created sessionCompactionService.test.ts to verify batch deletions, metric emissions, vacuuming, and error handling with 100% code coverage.

Security Considerations

• The use of bounded batches prevents potential DB connection starvation or excessive lock times on the sessions table.
• Calculating the cutoff date and deleting strictly expires_at < cutoff OR revoked_at < cutoff prevents deleting active rows even during a bad-clock event because active sessions have an expires_at in the future.

[drips-wave]

@Anadudev Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits