fix: Use token expiration for ephemeral sessions

[come-nc]

Summary

Since #56215 ephemeral sessions can be used for all endpoints for 5 minutes, let’s remove the middleware and flagging in-session system and rely on the token expiration stored in database instead.
This avoids any issue related to the PHP session expiring, the renewed session will keep the same expiration.

Checklist

• Code is properly formatted
• Sign-off message is added to all commits
• Tests (unit, integration, api and/or acceptance) are included
• Screenshots before/after for front-end changes
• Documentation (manuals or wiki) has been updated or is not required
• Backports requested where applicable (ex: critical bugfixes)
• Labels added where applicable (ex: bug/enhancement, 3. to review, feature component)
• Milestone added for target branch/version (ex: 32.x for stable32)

AI (if applicable)

• The content of this PR was partly or fully generated using AI

[come-nc]

/backport to stable34