fix(session): keep cooldown trackers and trim stale chunks by key

Cleanup evicted a refresh tracker by last attempt time alone. A tracker
could leave its cooldown early. Cleanup now also requires the cooldown
to be over.

The stale chunk trim deleted an index range derived from the chunk
count. A sparse key set kept stale high keys and failed the read. The
trim now deletes every key at or above token_total.

session_chunk_manager.go

@@ -445,9 +445,10 @@ func (cm *ChunkManager) processChunkedToken(chunks map[int]*sessions.Session, co
 				// not clear cookies above n). token_total is the authoritative
 				// count; drop the excess rather than failing — which forced a
 				// re-auth and discarded the still-valid new token (R129).
-				n := len(chunks)
-				for i := total; i < n; i++ {
-					delete(chunks, i)
+				for i := range chunks {
+					if i >= total {
+						delete(chunks, i)
+					}
 				}
 			}
 			if len(chunks) < total {