Login: cancella le key scadute dell'utente (#41)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

src/backend/services/auth_service.py

@@ -92,6 +92,10 @@ async def issue_api_key(db: AsyncSession, user: User) -> str:
     """Create a new session key for the user and return it in clear (once)."""
     key = generate_api_key()
     now = utcnow()
+    # Housekeeping: drop this user's expired keys so the table does not grow forever.
+    await db.execute(
+        delete(ApiKey).where(ApiKey.user_id == user.id, ApiKey.expires_at <= now)
+    )
     db.add(
         ApiKey(
             user_id=user.id,