[issue] Required Failure to repair
Concrete bug, error, failing test, CI failure, or UI defect. Include the exact symptom, minimal reproduction, expected and actual behavior, environment, constraints, non-goals, acceptance criteria, and authority boundary for Git, external systems, production data, and publication.
/ak:fix "POST /api/sessions returns 500 when expiresAt is absent. Reproduce with the focused API test, preserve the response contract, and do not commit or deploy." --review