Session management

All routes should be subject to session managment.

Sessions are distinct from authentication and authorisation. E.g. you can have a session even if you're not logged in.

Start by mapping the repository's route entry points and existing authentication or authorization handling. Determine how sessions should apply to every route while remaining distinct from login state, then document the expected session behavior and boundaries before implementation.

Written by the indexing model from the issue text.