Horizontal scaling readiness

Remove in-memory state - sessions, rate-limit counters not already in Redis - that would break with multiple instances. Verify by running two instances behind a load balancer locally.

In-memory state works flawlessly on one instance and fails intermittently on two, which is the worst possible failure schedule: it appears in production, under load, and not in staging.