Replace process-local session cache with pluggable session cache backend

backend/app/main.py

@@ -46,6 +46,7 @@ from app.routers import (
 from app.startup import startup_shared_resources
 from app.utils.fail2ban_client import Fail2BanConnectionError, Fail2BanProtocolError
 from app.utils.runtime_state import ApplicationState, RuntimeState
+from app.utils.session_cache import InMemorySessionCache
 from app.utils.setup_state import is_setup_complete_cached, set_setup_complete_cache
 
 log: structlog.stdlib.BoundLogger = structlog.get_logger()
@@ -289,6 +290,7 @@ def create_app(settings: Settings | None = None) -> FastAPI:
     # shared Starlette state bag itself does not hold mutable business state.
     app.state = ApplicationState(RuntimeState())
     app.state.settings = resolved_settings
+    app.state.session_cache = InMemorySessionCache()
     set_setup_complete_cache(app, False)
 
     # --- CORS ---