Feat v0.6.9 session lifetime config

- Admin-configurable session TTLs (access: 5m–60m, refresh: 1h–90d)
  stored in global_settings under "session" key
- "Keep me logged in" checkbox on login form; unchecked caps refresh
  token at 24h, checked uses full admin-configured TTL
- generateTokens() reads config instead of hardcoded 15m/7d; expires_in
  and refresh_expires_in in JSON response reflect actual TTLs
- Cookie max-age tracks chosen refresh lifetime (not hardcoded 604800)
- Optional idle timeout: admin toggle + configurable duration; server
  rejects refresh if last_activity_at exceeds threshold
- Client SDK activity ping (POST /auth/activity, debounced 1/min)
- Admin Settings > Session section with dropdowns for all three knobs
- 7 new unit tests for duration parsing, clamping, and defaults

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/store/interfaces.go

@@ -13,6 +13,13 @@ import (
 // ErrSystemGroup is returned when attempting to delete a system-sourced group.
 var ErrSystemGroup = errors.New("system groups cannot be deleted")
 
+// RefreshTokenInfo holds extended metadata for a refresh token row.
+type RefreshTokenInfo struct {
+	UserID         string
+	KeepLogin      bool
+	LastActivityAt *time.Time
+}
+
 // =========================================
 // STORES — Data Access Layer
 // =========================================
@@ -79,11 +86,13 @@ type UserStore interface {
 	ListActiveUserIDs(ctx context.Context) ([]string, error)
 
 	// Refresh tokens
-	CreateRefreshToken(ctx context.Context, userID, tokenHash string, expiresAt time.Time) error
+	CreateRefreshToken(ctx context.Context, userID, tokenHash string, expiresAt time.Time, keepLogin bool) error
 	GetRefreshToken(ctx context.Context, tokenHash string) (userID string, err error)
+	GetRefreshTokenInfo(ctx context.Context, tokenHash string) (*RefreshTokenInfo, error)
 	RevokeRefreshToken(ctx context.Context, tokenHash string) error
 	RevokeAllRefreshTokens(ctx context.Context, userID string) error
 	CleanExpiredTokens(ctx context.Context) error
+	UpdateRefreshTokenActivity(ctx context.Context, userID string) error
 
 	// ── CS1 additions ──