fix(auth): set session expires_at to non-nullable with 1 year max

app/models.py

@@ -28,7 +28,7 @@ class UserSession(Base):
     token = Column(String(64), primary_key=True)
     user_id = Column(Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False)
     created_at = Column(DateTime, default=_utcnow)
-    expires_at = Column(DateTime, nullable=True)
+    expires_at = Column(DateTime, nullable=False)
 
     user = relationship("User", back_populates="sessions")