fix(security): prevent mass assignment in session creation endpoint

[KrutagyaKaneria]

📋 Description

This PR strengthens the security of the session creation endpoint by preventing potential mass assignment during session creation.

✨ Changes Made

• Removed the direct spread of req.body into the session document.
• Explicitly selected only the allowed client-controlled fields before creating a session.
• Ensured the authenticated user's ID is always used as the session owner and cannot be overridden by client input.
• Updated the validation middleware to use the sanitized result returned by the schema validation.
• Reviewed the session creation flow to ensure only validated input reaches the controller.

🔒 Security Benefits

• Prevents unauthorized field assignment.
• Eliminates the possibility of overriding server-controlled fields such as user.
• Improves trust boundaries between client input and persisted data.
• Establishes a safer coding pattern for future create/update operations.

🧪 Testing

• Verified normal session creation still works.
• Verified authenticated ownership is preserved.
• Verified injected user fields are ignored.
• Verified unknown fields are not persisted.
• Verified existing frontend functionality remains unchanged.

Closes #464

#GSSoC
#ECSoC26

This PR is submitted as part of GirlScript Summer of Code (GSSoC) 2026.

This change restores compatibility for fresh Supabase database setups without modifying historical migrations. Kindly review and consider approving it if it aligns with the project's database maintenance and developer experience goals. Thank you for your valuable feedback!