fix(uds-auth): keep sessions until manual sign-out; refresh expired UAC tokens by QR (0.3.20)

Users were asked to sign in again every ~30 minutes, even while active.

Session lifetime
- Browser: UDS_SESSION kept its login-time Max-Age and was never re-issued,
  so the cookie vanished 30 min after login. Re-issue it on use (throttled
  by slidingInterval).
- Desktop: remote.mux WS traffic never passed the HTTP auth middleware, so
  the idle TTL never slid. assertPrincipalLive now reports activity and
  slides the session and the account's bridges (throttled).
- New setting sessionIdleTimeoutHours (Settings page + config). Default 0 =
  no automatic sign-out; only a manual sign-out ends a session, so
  conversations and night-time cron are never cut off. 0.5-168 enables an
  idle timeout with the 7-day cap. The TTL is read live.
- Stores support long TTLs: the absolute cap follows the TTL, older 7-day
  sessions are lifted on activity, and expiry timers re-arm instead of
  overflowing setTimeout (~24.8 days).

UAC token check
- Every 2 hours (and 1 min after start) each QR session's token is checked
  against icenterapi. A rejected token is only flagged, never a sign-out.
  Network errors, 5xx and bad JSON keep the previous verdict (the old 6h
  check revoked all of an account's sessions on any failure, including
  outages).
- GET /uds-auth/session-status (non-sliding) returns alive + tokenValid.
  The client probes it every minute and on focus: a gone session signs the
  UI out with a notice; a rejected token opens a refresh QR once.
- Scanning in refresh mode writes the new token into every live session of
  the account and the skill credential cache in place: no new session, no
  reload. Other accounts are rejected (token_refresh_emp_mismatch).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

uds-auth/lib/config.js

@@ -23,6 +23,7 @@ const DEFAULT_CONFIG = {
   originSystemCode: '',
   retainSkillCredentialsOnLogout: true,
   skillCredentialTtlSeconds: 7 * 24 * 60 * 60,
+  sessionIdleTimeoutHours: 0,
   outboundAllowedHosts: 'icenterapi.zte.com.cn,icentermsg.dt.zte.com.cn',
   initialAdminEmpNo: '',
   allowOpenRegistration: true,
@@ -44,7 +45,8 @@ const INTERNAL = {
     storeType: 'memory',
     redisUrl: 'redis://localhost:6379',
     cookieName: 'UDS_SESSION',
-    cookieMaxAge: 1800000,
+    // Default only; the live idle TTL comes from sessionIdleTimeoutHours (see lib/index.js).
+    cookieMaxAge: 24 * 60 * 60 * 1000,
   },
 }