perf: partial index for active session lookups

[Anadudev]

Closes #494

Description

This PR addresses performance regressions in postgresSessionStore where query p95s grew linearly with the number of historical (revoked or expired) session rows. We have introduced a partial index on (user_id) WHERE revoked_at IS NULL to speed up active session lookups and effectively filter out the unbounded historical data.

Additionally, to ensure query plans don't quietly regress back to sequential scans in the future, we have implemented an EXPLAIN baseline capture system and wired an automated test alert that fails if the query plan cost exceeds baseline * 2.

Changes

• Database Migration: Added 020_add_partial_index_active_sessions.sql which creates idx_sessions_active_user_id as a partial index on sessions(user_id) WHERE revoked_at IS NULL.
• Explain Baseline Capture: Added scripts/capture-explain.ts that runs EXPLAIN (FORMAT JSON) on key session queries and records the output to src/db/fixtures/explain_baselines.json.
• Regression Tests: Added sessionRepository.explain.test.ts which simulates validating the query plan against the baseline fixture and raises a strict regression alarm if the total cost exceeds double the baseline cost or if a sequential scan is substituted for an index scan.

Security Considerations

• The query plan checking is strictly deterministic in CI and throws an explicit Regression Alarm to avoid silent performance degradation affecting availability.
• The partial index is carefully constrained by WHERE revoked_at IS NULL, avoiding bloat from dead sessions and keeping the index small and efficient strictly for active authentication paths.

[drips-wave]

@Anadudev Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits