Red phase: CreateSessionTest covers token, user, createdAt, 7-day expiry, persistence, and fresh instance.