User sessions should store basic device or contextual metadata so admins and future security flows can distinguish active sessions. Expired sessions should also be cleaned up from the database instead of accumulating indefinitely.

We need to research the best way to derive useful session identification data from requests, such as device name, browser, operating system, IP address, user agent, or other safe metadata. The implementation should avoid over-collecting data and should store only what is useful for identifying sessions in the admin UI.

Goal
Improve session tracking and lifecycle management by storing useful session metadata, displaying enough context to identify sessions, and removing expired sessions automatically.

Checklist

• research how to derive device name or useful session metadata from request headers/user agent
• define the session metadata fields to store, e.g. device, browser, OS, user agent, IP address, or other context
• update the database schema to persist session metadata
• populate session metadata when creating user sessions
• expose session metadata through backend/OpenAPI responses where needed
• add a cleanup job or maintenance path to purge expired user sessions from the database
• make sure expired sessions are not treated as active anywhere in the system
• add or update the smallest relevant tests for session metadata and expired-session cleanup