added limits and cleanup for sessions

src/main/resources/application.yml

@@ -35,6 +35,17 @@ spring:
 telegram:
   bot-token: ${TELEGRAM_BOT_TOKEN}
 
+app:
+  session:
+    # Maximum number of active sessions per user (multi-device support)
+    max-active-per-user: ${APP_SESSION_MAX_ACTIVE_PER_USER:5}
+    # Batch cleanup configuration
+    cleanup:
+      # Number of expired sessions to delete per batch
+      batch-size: ${APP_SESSION_CLEANUP_BATCH_SIZE:5000}
+      # Maximum number of batches to process per cleanup run
+      max-batches-per-run: ${APP_SESSION_CLEANUP_MAX_BATCHES:20}
+
 logging:
   level:
     root: INFO