several changes:

* api calls for auth

* exchange now bind to user

backend/settings.py

@@ -16,6 +16,7 @@ class Settings(BaseSettings):
     log_level: str = "info"
     database_url: str = "sqlite:///:memory:"
     api_base: str = "/api/v1"
+    session_expiry_seconds: int = 3600 * 24 * 7  # 7 days
     hmac_key: str | None = None
 
     model_config = ConfigDict(env_file=".env", env_file_encoding="utf-8")