Feat v0.6.9 session lifetime config

- Admin-configurable session TTLs (access: 5m–60m, refresh: 1h–90d)
  stored in global_settings under "session" key
- "Keep me logged in" checkbox on login form; unchecked caps refresh
  token at 24h, checked uses full admin-configured TTL
- generateTokens() reads config instead of hardcoded 15m/7d; expires_in
  and refresh_expires_in in JSON response reflect actual TTLs
- Cookie max-age tracks chosen refresh lifetime (not hardcoded 604800)
- Optional idle timeout: admin toggle + configurable duration; server
  rejects refresh if last_activity_at exceeds threshold
- Client SDK activity ping (POST /auth/activity, debounced 1/min)
- Admin Settings > Session section with dropdowns for all three knobs
- 7 new unit tests for duration parsing, clamping, and defaults

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/auth/builtin.go

@@ -24,13 +24,17 @@ func (p *BuiltinProvider) SupportsRegistration() bool { return true }
 
 func (p *BuiltinProvider) Authenticate(c *gin.Context, stores store.Stores) (*Result, error) {
 	var req struct {
-		Login    string `json:"login" binding:"required"`
-		Password string `json:"password" binding:"required"`
+		Login     string `json:"login" binding:"required"`
+		Password  string `json:"password" binding:"required"`
+		KeepLogin bool   `json:"keep_login"`
 	}
 	if err := c.ShouldBindJSON(&req); err != nil {
 		return nil, err
 	}
 
+	// Stash keep_login in context for generateTokens
+	c.Set("keep_login", req.KeepLogin)
+
 	user, err := stores.Users.GetByLogin(c.Request.Context(), req.Login)
 	if err != nil {
 		return nil, ErrInvalidCreds