fix(#707): escape session GC scan scope

apps/gateway/src/gc/session-gc.service.ts

@@ -13,6 +13,11 @@ export interface GCResult {
   };
 }
 
+/** Escape Redis glob metacharacters so a session identifier is always literal. */
+function escapeRedisGlobLiteral(value: string): string {
+  return value.replace(/[\\*?\[\]]/g, '\\$&');
+}
+
 @Injectable()
 export class SessionGCService {
   constructor(
@@ -43,7 +48,7 @@ export class SessionGCService {
     const result: GCResult = { sessionId, cleaned: {} };
 
     // 1. Valkey: delete all session-scoped keys
-    const pattern = `mosaic:session:${sessionId}:*`;
+    const pattern = `mosaic:session:${escapeRedisGlobLiteral(sessionId)}:*`;
     const valkeyKeys = await this.scanKeys(pattern);
     if (valkeyKeys.length > 0) {
       await this.redis.del(...valkeyKeys);