pub async fn purge_expired(pool: &PgPool) -> AppResult<u64>
Removes expired sessions and stale OIDC login attempts.