Fix /status reporting sessions as zero

[felladrin]

Fixes the /status endpoint always reporting sessions: 0.

Currently, the memory-bounding cleanup added in #2157 calls verifiedTokens.clear() on the whole set every 60 seconds. That wipes the count every minute, so getVerifiedTokensAmount() only returns a non-zero value if a search happens to land in the current 60-second window. Before #2157 the set was never cleared, so sessions meant "distinct sessions since restart", which is the basis it shares with textualSearches/graphicalSearches when computing the per-session averages.

This PR keeps memory bounded without destroying the metric: it evicts idle tokens with a per-token TTL instead of a full wipe, and tracks distinct sessions with a monotonic counter kept separate from the expiring cache, so the count stays on the "since restart" basis.

What changed

File	Change
server/verifiedTokens.ts	Set -> Map<token, lastSeen>; cleanup evicts only entries idle longer than 30 min; sessions now comes from a monotonic sessionCount that survives eviction
server/verifyTokenAndRateLimit.ts	Every authorized request now records/refreshes the token's last-seen time, so an active session keeps its slot and returning after the idle window counts as a new session
server/verifiedTokens.test.ts	New tests: distinct-token counting, count surviving eviction, returning-after-eviction re-count, and an active token staying alive across the idle window

How to test

1. npx vitest run server/verifiedTokens.test.ts server/verifyTokenAndRateLimit.test.ts (20 tests pass).
2. Run the app, do a search, then hit /status: sessions reads 1 and stays there past the 60-second mark (before this change it dropped back to 0).