SSM port-forward tunnel gotchas: zombie sessions, cred expiry, slow first connect

Reaching a private RDS via aws ssm start-session (AWS-StartPortForwardingSessionToRemoteHost) has three non-obvious failure modes. (1) Killing the local session-manager-plugin process does NOT end the AWS-side session — zombies pile up, saturate the instances session slots, and wedge new tunnels: the local port opens but no data ever flows. Explicitly aws ssm terminate-session the leftovers, and clean them on startup. (2) Do not bake static exported credentials (aws configure export-credentials) into a long-running server — they are short-lived (~1h) and the tunnel dies when they expire with no ability to refresh; let the aws CLI resolve creds from the profile on each (re)start so it auto-refreshes. (3) The first DB connection through a freshly opened forward takes ~10s to establish the remote channel, so set a generous connectionTimeout and pre-warm one connection at startup instead of on the first user request.