Function sanitize_session_key 

pub fn sanitize_session_key(key: &str) -> String

Replace every character outside [A-Za-z0-9_-] with _. Idempotent.

Callers building session keys must pre-apply this so the runtime HashMap key, the on-disk JSONL filename, and the session_id column in memory backends all agree.