feat(session): integrate actix-web framework with enhanced session management

- Added actix-web and actix-multipart dependencies to Cargo.toml
- Integrated actix-web ResponseError trait for AppError handling
- Migrated session module to use actix-web request lifecycle management
- Enhanced Session struct with request-local state handling capabilities
- Implemented proper HTTP status code mapping for various error types
- Added comprehensive session middleware integration points
- Updated session state persistence and modification tracking logic
- Integrated proper JSON response formatting for error messages
- Added support for session renewal, purge, and unchanged state management

error.rs

@@ -1,3 +1,4 @@
+use actix_web::HttpResponse;
 use thiserror::Error;
 
 pub type AppResult<T> = Result<T, AppError>;
@@ -103,3 +104,45 @@ pub enum AppError {
     #[error("transaction error")]
     TxnError,
 }
+
+impl actix_web::ResponseError for AppError {
+    fn status_code(&self) -> actix_web::http::StatusCode {
+        use actix_web::http::StatusCode;
+        match self {
+            AppError::Unauthorized => StatusCode::UNAUTHORIZED,
+            AppError::Forbidden(_) => StatusCode::FORBIDDEN,
+            AppError::NotFound(_) | AppError::UserNotFound => StatusCode::NOT_FOUND,
+            AppError::BadRequest(_) | AppError::Parse(_) | AppError::CaptchaError => {
+                StatusCode::BAD_REQUEST
+            }
+            AppError::Conflict(_) | AppError::AccountAlreadyExists | AppError::EmailExists => {
+                StatusCode::CONFLICT
+            }
+            AppError::QuotaExceeded(_) => StatusCode::TOO_MANY_REQUESTS,
+            AppError::InvalidPassword
+            | AppError::PasswordTooWeak
+            | AppError::InvalidTwoFactorCode
+            | AppError::TwoFactorRequired
+            | AppError::TwoFactorAlreadyEnabled
+            | AppError::TwoFactorNotSetup
+            | AppError::TwoFactorNotEnabled
+            | AppError::InvalidResetToken
+            | AppError::ResetTokenExpired
+            | AppError::InvalidEmailCode
+            | AppError::RsaDecodeError
+            | AppError::RsaGenerationError => StatusCode::BAD_REQUEST,
+            AppError::PasswordHashError(_) => StatusCode::INTERNAL_SERVER_ERROR,
+            _ => StatusCode::INTERNAL_SERVER_ERROR,
+        }
+    }
+
+    fn error_response(&self) -> HttpResponse {
+        let status = self.status_code();
+        let message = if status == actix_web::http::StatusCode::INTERNAL_SERVER_ERROR {
+            "internal server error".to_string()
+        } else {
+            self.to_string()
+        };
+        HttpResponse::build(status).json(serde_json::json!({ "error": message }))
+    }
+}