Disable session cache by default and make it opt-in for single-process deployments

backend/app/config.py

@@ -45,6 +45,21 @@ class Settings(BaseSettings):
         ge=1,
         description="Number of minutes a session token remains valid after creation.",
     )
+    session_cache_enabled: bool = Field(
+        default=False,
+        description=(
+            "Enable the in-memory session validation cache. "
+            "Disable it in multi-worker deployments to avoid stale revoked sessions."
+        ),
+    )
+    session_cache_ttl_seconds: float = Field(
+        default=10.0,
+        ge=0.0,
+        description=(
+            "How long (seconds) a cached session validation entry remains fresh. "
+            "Ignored when session_cache_enabled is false."
+        ),
+    )
     timezone: str = Field(
         default="UTC",
         description="IANA timezone name used when displaying timestamps in the UI.",