- Periodic cleanup loop deletes stale clients based on SESSION_IDLE_TIMEOUT - Orphaned sessions (no clients) are cleaned up automatically - last_seen already updated on each authenticated request via GetSessionByToken