fix: prune old backup safety-copies and expired admin sessions instead of letting them pile up forever

Every backup restore was leaving a .before-restore-<timestamp> safety
copy of both mbs.db and .env with no cleanup — would accumulate
forever on a panel that restores regularly. Now keeps the 5 most
recent and prunes the rest right after each restore. Verified: 8
fake copies pruned down to exactly the 5 newest, oldest-first.

admin_sessions rows also never got deleted once expired (only ever
filtered out of queries via expires_at>?) — same shape of problem.
Piggybacks on the existing 90s periodic_sync heartbeat in bot.py
instead of adding a new one.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

db.py

@@ -382,6 +382,11 @@ def delete_admin_session(token: str):
         conn.execute("DELETE FROM admin_sessions WHERE token=?", (token,))
 
 
+def delete_expired_admin_sessions():
+    with get_conn() as conn:
+        conn.execute("DELETE FROM admin_sessions WHERE expires_at<=?", (now_iso(),))
+
+
 def list_all_subscriptions(limit: int = 200):
     with get_conn() as conn:
         rows = conn.execute(