refactor: make session store operations deterministic with redis support

[sammargolis]

Summary

• introduces explicit SessionStore contract and deterministic async mutating operations
• adds Redis-backed hosted session persistence/event fanout path with TTL semantics
• updates transcription routes/e2e tests to await session mutations

Security impact

• improves hosted multi-instance reliability and consistency for protected transcription flows
• no relaxation of auth or route protection controls

PHI handling impact

• keeps session data ephemeral with expiry semantics
• no new durable PHI database writes introduced by this change

Tests executed

• pnpm build:test
• pnpm exec tsc --project apps/web/tsconfig.json --noEmit

Rollback plan

• revert this PR to restore in-memory-only session store behavior