feat: add in-memory state expiration to StateManagerMemory

Implement automatic eviction of idle client states in the memory state
manager using a heap-based expiration system. States are touched on
get/set and purged after token_expiration seconds of inactivity. Locked
states defer eviction until their lock is released.

Also fix StateManager.create to respect an explicit memory mode when a
Redis URL is configured.

Author: FarhanAliRaza