Remove beaker dependency, switch to Pyramid SignedCookieSessionFactory

Replace server-side session backends (redis, file, database, memcached)
with client-side signed cookie sessions. Users will need to
re-authenticate after deploy.

- Rewrite rc_beaker.py to use pyramid.session.SignedCookieSessionFactory
- Gut user_sessions.py to cookie-only stub
- Drop beaker.container from memory_lru_dict.py (pure repoze.lru)
- Migrate ini configs from beaker.session.* to session.* namespace
- Remove beaker==1.13.0 from requirements.txt
- Remove beaker.backends entry points from pyproject.toml
- Preserve backward-compat fallbacks for encryption key resolution

configs/production.ini

@@ -46,7 +46,7 @@ use = egg:gunicorn#main
 ; allows to set RhodeCode under a prefix in server.
 ; eg https://server.com/custom_prefix. Enable `filter-with =` option below as well.
 ; And set your prefix like: `prefix = /custom_prefix`
-; be sure to also set beaker.session.cookie_path = /custom_prefix if you need
+; be sure to also set session.cookie_path = /custom_prefix if you need
 ; to make your cookies only work on prefix url
 [filter:proxy-prefix]
 use = egg:PasteDeploy#prefix
@@ -76,7 +76,7 @@ use = egg:rhodecode-enterprise-ce
 
 ; encryption key used to encrypt social plugin tokens,
 ; remote_urls with credentials etc, if not set it defaults to
-; `beaker.session.secret`
+; `session.secret`
 #rhodecode.encrypted_values.secret =
 
 ; decryption strict mode (enabled by default). It controls if decryption raises
@@ -561,51 +561,19 @@ rc_cache.cache_license.expiration_time = 300
 #rc_cache.cache_license.arguments.key_prefix = custom-prefix-
 
 
-; ##############
-; BEAKER SESSION
-; ##############
+; ######################
+; SESSION CONFIGURATION
+; ######################
 
-; beaker.session.type is type of storage options for the logged users sessions. Current allowed
-; types are file, ext:redis, ext:database, ext:memcached
-; Fastest ones are ext:redis and ext:database, DO NOT use memory type for session
-#beaker.session.type = file
-#beaker.session.data_dir = /var/opt/rhodecode_data/sessions
-
-; Redis based sessions
-beaker.session.type = ext:redis
-beaker.session.url = redis://redis:6379/2
-
-; DB based session, fast, and allows easy management over logged in users
-#beaker.session.type = ext:database
-#beaker.session.table_name = db_session
-#beaker.session.sa.url = postgresql://postgres:secret@localhost/rhodecode
-#beaker.session.sa.url = mysql://root:secret@127.0.0.1/rhodecode
-#beaker.session.sa.pool_recycle = 3600
-#beaker.session.sa.echo = false
-
-beaker.session.key = rhodecode
-beaker.session.secret = production-rc-uytcxaz
-beaker.session.lock_dir = /data_ramdisk/lock
-
-; Secure encrypted cookie. Requires AES and AES python libraries
-; you must disable beaker.session.secret to use this
-#beaker.session.encrypt_key = key_for_encryption
-#beaker.session.validate_key = validation_key
-
-; Sets session as invalid (also logging out user) if it haven not been
-; accessed for given amount of time in seconds
-beaker.session.timeout = 2592000
-beaker.session.httponly = true
-
-; Path to use for the cookie. Set to prefix if you use prefix middleware
-#beaker.session.cookie_path = /custom_prefix
-
-; Set https secure cookie
-beaker.session.secure = false
-
-; default cookie expiration time in seconds, set to `true` to set expire
-; at browser close
-#beaker.session.cookie_expires = 3600
+; Cookie-based signed sessions (no server-side session store needed)
+session.secret = production-rc-uytcxaz
+session.key = rhodecode
+session.timeout = 2592000
+session.httponly = true
+session.secure = false
+;session.cookie_path = /custom_prefix
+;session.domain =
+;session.samesite = Lax
 
 ; #############################
 ; SEARCH INDEXING CONFIGURATION