fix(auth): set session expires_at to non-nullable with 1 year max

app/auth.py

@@ -25,7 +25,7 @@ def verify_password(password: str, password_hash: str) -> bool:
 
 def create_session(user_id: int, db: DbSession, remember_me: bool = False) -> str:
     token = uuid4().hex
-    expires_at = (datetime.now(timezone.utc) + timedelta(days=365)) if remember_me else None
+    expires_at = datetime.now(timezone.utc) + timedelta(days=365)
     db.add(UserSession(token=token, user_id=user_id, expires_at=expires_at))
     db.commit()
     return token