Add no-op session cache when session cache is disabled

Use NoOpSessionCache in backend/app/main.py and dynamically switch cache implementation in backend/app/dependencies.py so disabled cache mode remains safe while get_session_cache always returns a valid object.

backend/app/main.py

@@ -46,7 +46,7 @@ from app.routers import (
 from app.startup import startup_shared_resources
 from app.utils.fail2ban_client import Fail2BanConnectionError, Fail2BanProtocolError
 from app.utils.runtime_state import ApplicationState, RuntimeState
-from app.utils.session_cache import InMemorySessionCache
+from app.utils.session_cache import InMemorySessionCache, NoOpSessionCache
 from app.utils.setup_state import is_setup_complete_cached, set_setup_complete_cache
 
 log: structlog.stdlib.BoundLogger = structlog.get_logger()
@@ -290,7 +290,11 @@ def create_app(settings: Settings | None = None) -> FastAPI:
     # shared Starlette state bag itself does not hold mutable business state.
     app.state = ApplicationState(RuntimeState())
     app.state.settings = resolved_settings
-    app.state.session_cache = InMemorySessionCache()
+    app.state.session_cache = (
+        InMemorySessionCache()
+        if resolved_settings.session_cache_enabled and resolved_settings.session_cache_ttl_seconds > 0.0
+        else NoOpSessionCache()
+    )
     set_setup_complete_cache(app, False)
 
     # --- CORS ---