Phalcon credential expiration and session invalidation strategy

Phalcon's Phalcon\\Security component provides password hashing with bcrypt and Argon2id, but the framework does not include built-in credential expiration, rotation policies, or automatic session invalidation when credentials change. The Phalcon\\Auth\\Adapter\\Session stores user identity in the session without monitoring password age or revocation events. Similarly, Phalcon\\Security\\JWT only encodes and decodes tokens; token blacklisting for revocation requires an external store such as Redis or a database table.

Applications that enforce least-privilege access must therefore implement custom timestamp checks (for example, a password_changed_at column) and manually destroy sessions or reject tokens when credentials expire or are rotated. The ACL adapters (Memory, Database) evaluate permissions at request time but do not integrate with credential lifecycle events.

What patterns have proven reliable for coupling credential expiration with session and token invalidation in Phalcon 5.x? Does the framework provide any event hooks or middleware entry points that can centralize this logic without scattering checks across controllers? Which storage backend (Redis, database, APCu) integrates most cleanly with the existing session and JWT components for revocation lists?