Session implementation task

Implement server-side sessions for an Express 5 application. The project uses express-session and must follow the currently documented production approach for proxy settings, secure cookies, session stores, and secret configuration.

Ground behavioral claims in official Express or express-session documentation and cite the exact pages used. Do not rely on remembered Express 4 defaults. Flag any deployment-specific assumption that cannot be verified from the repository or official documentation.