fix(uds-auth): keep sessions until manual sign-out; refresh expired UAC tokens by QR (0.3.20)

Users were asked to sign in again every ~30 minutes, even while active.

Session lifetime
- Browser: UDS_SESSION kept its login-time Max-Age and was never re-issued,
  so the cookie vanished 30 min after login. Re-issue it on use (throttled
  by slidingInterval).
- Desktop: remote.mux WS traffic never passed the HTTP auth middleware, so
  the idle TTL never slid. assertPrincipalLive now reports activity and
  slides the session and the account's bridges (throttled).
- New setting sessionIdleTimeoutHours (Settings page + config). Default 0 =
  no automatic sign-out; only a manual sign-out ends a session, so
  conversations and night-time cron are never cut off. 0.5-168 enables an
  idle timeout with the 7-day cap. The TTL is read live.
- Stores support long TTLs: the absolute cap follows the TTL, older 7-day
  sessions are lifted on activity, and expiry timers re-arm instead of
  overflowing setTimeout (~24.8 days).

UAC token check
- Every 2 hours (and 1 min after start) each QR session's token is checked
  against icenterapi. A rejected token is only flagged, never a sign-out.
  Network errors, 5xx and bad JSON keep the previous verdict (the old 6h
  check revoked all of an account's sessions on any failure, including
  outages).
- GET /uds-auth/session-status (non-sliding) returns alive + tokenValid.
  The client probes it every minute and on focus: a gone session signs the
  UI out with a notice; a rejected token opens a refresh QR once.
- Scanning in refresh mode writes the new token into every live session of
  the account and the skill credential cache in place: no new session, no
  reload. Other accounts are rejected (token_refresh_emp_mismatch).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

uds-auth/lib/i18n.js

@@ -30,6 +30,12 @@ export const MESSAGES = {
     'ui.deployConfig': '部署配置',
     'ui.userSearchUrl': '用户搜索 URL（token 校验）',
     'ui.workspaceRoot': '工作区根目录（空=$DSH_HOME/user-workspaces）',
+    'ui.sessionIdleTimeoutHours': '会话闲置超时（小时，0 = 不自动退出）',
+    'ui.tokenExpiredTitle': 'UAC 登录已过期',
+    'ui.tokenExpiredHint': '请扫码刷新，不影响当前会话和定时任务',
+    'ui.tokenRefreshed': 'UAC 登录已刷新',
+    'ui.sessionExpiredSignedOut': '登录已过期，已自动退出',
+    'ui.sessionIdleTimeoutHint': '默认 0：只有手动退出才会退出，定时任务和进行中的会话不受影响。大于 0 时，闲置超过该时长自动退出（范围 0.5–168）。UAC token 过期不会退出，只会提示扫码刷新。',
     'ui.allowRawAgentToken': '允许 Skill 获取原始 UDS token',
     'ui.allowRawAgentTokenHint': '开启后，具备当前任务 credentials scope 的本机 Skill 可获取工号和 token。只在业务确实需要原始 token 时开启。',
     'ui.saveConfig': '保存配置',
@@ -166,6 +172,8 @@ export const MESSAGES = {
     'err.invalid_user_search_url': 'userSearchUrl 必须是 https URL',
     'err.invalid_workspace_root': 'workspaceRoot 必须是绝对路径',
     'err.invalid_ttl': 'TTL 超出允许范围',
+    'err.invalid_session_idle_timeout': '会话闲置超时需为 0（不自动退出）或 0.5–168 小时',
+    'err.token_refresh_emp_mismatch': '请用当前登录账号 {empNo} 扫码刷新（本次扫码账号：{scanned}）',
     'err.invalid_outbound_host': 'outbound 白名单 host 格式无效',
     'err.bootstrap_required': '系统尚未初始化管理员（当前扫码工号 {empNo}）。请设置环境变量 UDS_AUTH_INITIAL_ADMIN={empNo} 后重启 Harness；或先用「应急账号登录」进入，在设置中添加用户',
     'err.registration_closed': '未开放自动注册，请联系管理员',
@@ -228,6 +236,12 @@ export const MESSAGES = {
     'ui.deployConfig': 'Deploy config',
     'ui.userSearchUrl': 'User search URL (token verify)',
     'ui.workspaceRoot': 'Workspace root (empty=$DSH_HOME/user-workspaces)',
+    'ui.sessionIdleTimeoutHours': 'Session idle timeout (hours, 0 = never sign out)',
+    'ui.tokenExpiredTitle': 'UAC sign-in expired',
+    'ui.tokenExpiredHint': 'Scan to refresh it — your sessions and scheduled tasks keep running',
+    'ui.tokenRefreshed': 'UAC sign-in refreshed',
+    'ui.sessionExpiredSignedOut': 'Session expired — you have been signed out',
+    'ui.sessionIdleTimeoutHint': 'Default 0: only a manual sign-out ends the session; scheduled tasks and running conversations are unaffected. Above 0, sessions idle that long sign out (range 0.5–168). An expired UAC token never signs out — it only prompts a QR refresh.',
     'ui.allowRawAgentToken': 'Allow Skills to read the raw UDS token',
     'ui.allowRawAgentTokenHint': 'Enables local Skills with the current task credentials scope to read the employee number and token. Turn this on only when a workflow needs the raw token.',
     'ui.saveConfig': 'Save config',
@@ -359,6 +373,8 @@ export const MESSAGES = {
     'err.invalid_user_search_url': 'userSearchUrl must be an https URL',
     'err.invalid_workspace_root': 'workspaceRoot must be an absolute path',
     'err.invalid_ttl': 'TTL out of allowed range',
+    'err.invalid_session_idle_timeout': 'Session idle timeout must be 0 (never sign out) or 0.5–168 hours',
+    'err.token_refresh_emp_mismatch': 'Scan with the signed-in account {empNo} to refresh (scanned: {scanned})',
     'err.invalid_outbound_host': 'Invalid outbound host entry',
     'err.bootstrap_required': 'Admin not initialized (scanned employee no. {empNo}). Set UDS_AUTH_INITIAL_ADMIN={empNo} and restart Harness, or sign in with the emergency account and add users in Settings',
     'err.registration_closed': 'Open registration is disabled; contact an admin',