feat(session): persistent browser context pool with lifecycle management

- SessionContextService: in-memory Map of live Playwright handles, reused
  per sessionName across exec_code/open_url calls; closed on module destroy
- SessionSchedulerService: @Interval closes idle sessions and deletes old
  closed ones using SESSION_IDLE_TIMEOUT_MINUTES / SESSION_DELETE_CLOSED_DAYS
- SessionService: onApplicationBootstrap closes all open sessions on restart;
  upsert marks status=open and sets lastUsedAt; adds markOpen/markClosed/
  touchLastUsed/findExpiredOpen/findOldClosed/findById helpers
- SessionEntity: status (open|closed) and lastUsedAt columns added
- AuthService: keeps browser alive after login, registers context in pool
- BrowserService: named sessions reuse persistent context; anonymous remain ephemeral
- AppConfig: all config fields declared with typed defaults; validate wired
  into ConfigModule so mis-configuration fails fast at startup
- ConfigService<AppConfig, true> used everywhere — no more untyped get() calls

.env.example

@@ -5,4 +5,13 @@ PORT=3000
 KEYS_DIR=keys
 
 # SQLite database path
-DB_PATH=data/sessions.db
+DB_PATH=data/sessions.db
+
+# Playwright executable (set in Docker; leave empty to use system default)
+# PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH=/usr/bin/chromium
+
+# Session lifecycle
+# Close open sessions that have been idle for longer than this many minutes
+SESSION_IDLE_TIMEOUT_MINUTES=30
+# Delete closed sessions whose updatedAt is older than this many days
+SESSION_DELETE_CLOSED_DAYS=7