HEL-269: 完成月结锁账、撤演示数据与代码收尾

锁账后写保护与闭期补录留痕；重开须审批并按版本链再结；列表/导出改走真实 API。

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: multica-agent <github@multica.ai>

src/bank_importer/auth.py

@@ -204,6 +204,7 @@ def create_session(
     token = secrets.token_urlsafe(32)
     token_hash = hashlib.sha256(token.encode("utf-8")).hexdigest()
     now = datetime.now(timezone.utc)
+    purge_expired_sessions(connection)
     with connection:
         connection.execute(
             """
@@ -220,6 +221,17 @@ def create_session(
     return token
 
 
+def purge_expired_sessions(connection: sqlite3.Connection) -> int:
+    """Drop expired or revoked session rows so they do not accumulate."""
+    now = utc_now()
+    with connection:
+        cursor = connection.execute(
+            "DELETE FROM sessions WHERE expires_at <= ? OR revoked_at IS NOT NULL",
+            (now,),
+        )
+    return int(cursor.rowcount or 0)
+
+
 def resolve_session(connection: sqlite3.Connection, token: str) -> sqlite3.Row | None:
     """Return the user row for a live session token, else None.