4 cases: returns Session with the generated token + supplied user; createdAt matches injected Clock now; expiresAt is now+7d; session is findable via SessionRepository->findByToken. fails red - CreateSession class missing.