fix(auth): set session expires_at to non-nullable with 1 year max

app/auth.py

@@ -25,7 +25,7 @@ def verify_password(password: str, password_hash: str) -> bool:
 
 def create_session(user_id: int, db: DbSession, remember_me: bool = False) -> str:
     token = uuid4().hex
-    expires_at = (datetime.now(timezone.utc) + timedelta(days=365)) if remember_me else None
+    expires_at = datetime.now(timezone.utc) + timedelta(days=365)
     db.add(UserSession(token=token, user_id=user_id, expires_at=expires_at))
     db.commit()
     return token

app/models.py

@@ -28,7 +28,7 @@ class UserSession(Base):
     token = Column(String(64), primary_key=True)
     user_id = Column(Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False)
     created_at = Column(DateTime, default=_utcnow)
-    expires_at = Column(DateTime, nullable=True)
+    expires_at = Column(DateTime, nullable=False)
 
     user = relationship("User", back_populates="sessions")