Session auth API

The same small backend as the complete one, but signed-in users are tracked with server-side sessions instead of JWT tokens: log in to get a session id, send it in the X-Session-Id header, and log out to end it.

What's included

• Sign Up and Log In routes: Log In returns a session id instead of a token
• A Session node that creates, validates and destroys sessions, with a Log Out route
• Every protected route reads the X-Session-Id header and answers 401 when the session is missing or expired
• A tasks API (list, create) scoped to the signed-in user, plus a Get Profile route
• Only the email is kept in the session: a Transform strips the password before it is stored
• Sessions are kept in memory and reset when the engine restarts: switch the Session nodes to the Redis store for production
• Set DATABASE_URL in the Environment node before you run