fix: prune old backup safety-copies and expired admin sessions instead of letting them pile up forever

Every backup restore was leaving a .before-restore-<timestamp> safety
copy of both mbs.db and .env with no cleanup — would accumulate
forever on a panel that restores regularly. Now keeps the 5 most
recent and prunes the rest right after each restore. Verified: 8
fake copies pruned down to exactly the 5 newest, oldest-first.

admin_sessions rows also never got deleted once expired (only ever
filtered out of queries via expires_at>?) — same shape of problem.
Piggybacks on the existing 90s periodic_sync heartbeat in bot.py
instead of adding a new one.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

bot.py

@@ -367,6 +367,10 @@ async def periodic_sync():
             await reconcile_pending_payments()
         except Exception:
             log.exception("payment reconciliation failed")
+        try:
+            db.delete_expired_admin_sessions()
+        except Exception:
+            log.exception("expired admin session cleanup failed")
         await asyncio.sleep(90)