P1: STS session tokens stored forever — no expiration cleanup #660

Summary

b.sessions map in STS has no expiration cleanup. Every AssumeRole call adds an entry that is never garbage-collected — OOM risk under sustained load. GetCallerIdentity doesn't validate if session is expired.

Missing Features

• GetFederationToken not implemented
• AssumeRoleWithSAML / AssumeRoleWithWebIdentity not implemented
• No session policy support (Policy field parsed but discarded)

Impact

P1 — Memory exhaustion under sustained load.

Fix

• Add janitor/TTL cleanup for expired sessions
• Validate session expiry in GetCallerIdentity

Files

• services/sts/backend.go