fix(uds-auth): keep sessions until manual sign-out; refresh expired UAC tokens by QR (0.3.20)

Users were asked to sign in again every ~30 minutes, even while active.

Session lifetime
- Browser: UDS_SESSION kept its login-time Max-Age and was never re-issued,
  so the cookie vanished 30 min after login. Re-issue it on use (throttled
  by slidingInterval).
- Desktop: remote.mux WS traffic never passed the HTTP auth middleware, so
  the idle TTL never slid. assertPrincipalLive now reports activity and
  slides the session and the account's bridges (throttled).
- New setting sessionIdleTimeoutHours (Settings page + config). Default 0 =
  no automatic sign-out; only a manual sign-out ends a session, so
  conversations and night-time cron are never cut off. 0.5-168 enables an
  idle timeout with the 7-day cap. The TTL is read live.
- Stores support long TTLs: the absolute cap follows the TTL, older 7-day
  sessions are lifted on activity, and expiry timers re-arm instead of
  overflowing setTimeout (~24.8 days).

UAC token check
- Every 2 hours (and 1 min after start) each QR session's token is checked
  against icenterapi. A rejected token is only flagged, never a sign-out.
  Network errors, 5xx and bad JSON keep the previous verdict (the old 6h
  check revoked all of an account's sessions on any failure, including
  outages).
- GET /uds-auth/session-status (non-sliding) returns alive + tokenValid.
  The client probes it every minute and on focus: a gone session signs the
  UI out with a notice; a rejected token opens a refresh QR once.
- Scanning in refresh mode writes the new token into every live session of
  the account and the skill credential cache in place: no new session, no
  reload. Other accounts are rejected (token_refresh_emp_mismatch).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

uds-auth/lib/session/memory-store.js

@@ -1,6 +1,6 @@
 import { createHash, randomBytes, timingSafeEqual } from 'node:crypto'
 import { readFile } from 'node:fs/promises'
-import { SessionStore, SESSION_ABSOLUTE_MAX_SECONDS } from './store.js'
+import { SessionStore, absoluteCapSeconds } from './store.js'
 import { atomicWriteJson } from '../utils/atomic-write.js'
 import { loadOrCreateSecretKey, sealSecret, openSecret } from '../utils/secret-box.js'
 
@@ -26,6 +26,9 @@ function safeEqualHex(a, b) {
  * Persistence (opts.file + opts.dataDir): bearer hashes and expiry in clear,
  * userData (may carry the UAC token) sealed with the plugin AES-GCM key.
  */
+/** Longest delay setTimeout honors (2^31 - 1 ms). */
+const MAX_TIMER_MS = 2_147_483_647
+
 export class MemoryStore extends SessionStore {
   /**
    * @param {{ file?: string, dataDir?: string, logger?: any }} [opts]
@@ -178,10 +181,16 @@ export class MemoryStore extends SessionStore {
       this._timers.delete(sessionId)
     }
     if (!ttlSeconds || ttlSeconds <= 0) return
+    // setTimeout fires immediately past ~24.8 days; long TTLs re-arm in chunks.
+    const delay = Math.min(ttlSeconds * 1000, MAX_TIMER_MS)
     const timer = setTimeout(() => {
+      this._timers.delete(sessionId)
       const row = this._sessions.get(sessionId)
-      if (row) this._removeRecord(sessionId, row)
-    }, ttlSeconds * 1000)
+      if (!row) return
+      const left = row.expiresAt - Date.now()
+      if (left > 0) this._scheduleExpiry(sessionId, Math.ceil(left / 1000))
+      else this._removeRecord(sessionId, row)
+    }, delay)
     // Do not keep the process alive solely for session TTLs (tests / short-lived hosts).
     if (typeof timer.unref === 'function') timer.unref()
     this._timers.set(sessionId, timer)
@@ -210,7 +219,7 @@ export class MemoryStore extends SessionStore {
     const ttl = Math.max(60, Number(ttlSeconds) || 1800)
     // Idle TTL slides via touch(); absolute lifetime is a fixed 7 days. (Was min(ttl, 7d),
     // which capped every session at its 30-min idle TTL and made sliding a no-op.)
-    const absoluteCap = SESSION_ABSOLUTE_MAX_SECONDS
+    const absoluteCap = absoluteCapSeconds(ttl)
     const record = {
       sessionId,
       bearerHash,
@@ -305,6 +314,10 @@ export class MemoryStore extends SessionStore {
     const row = this._purgeExpired(String(sessionId || ''))
     if (!row) return null
     const ttl = Math.max(60, Number(ttlSeconds) || 1800)
+    // "No auto sign-out" TTLs also lift the cap of sessions minted under the 7-day default.
+    if (absoluteCapSeconds(ttl) > absoluteCapSeconds(0)) {
+      row.absoluteExpiresAt = Math.max(row.absoluteExpiresAt || 0, Date.now() + ttl * 1000)
+    }
     const absLeft = row.absoluteExpiresAt
       ? Math.max(0, Math.floor((row.absoluteExpiresAt - Date.now()) / 1000))
       : ttl
@@ -323,6 +336,14 @@ export class MemoryStore extends SessionStore {
     return this._publicRecord(row)
   }
 
+  async updateUserData(sessionId, patch) {
+    const row = this._purgeExpired(String(sessionId || ''))
+    if (!row) return null
+    row.userData = { ...row.userData, ...patch }
+    this._scheduleSave()
+    return this._publicRecord(row)
+  }
+
   async revokeSession(sessionId) {
     const row = this._sessions.get(String(sessionId || ''))
     if (!row) return false