Green phase: CreateSession generates a token, creates a session with 7-day expiry, and persists it via SessionRepository.