SessionPromotionService

Promotes the half-authenticated pending session into a fully authenticated one.

While MFA verification is in progress, the user's identity is stored under pending_* session keys so an unverified session cannot be used to reach the API or the web UI as a logged-in user. After the second factor has been verified successfully, this service moves each pending value to its real session key and removes the pending copy. Keys that were never set stay absent - nothing is written for them.