fix(uds-auth): keep sessions until manual sign-out; refresh expired UAC tokens by QR (0.3.20)

Users were asked to sign in again every ~30 minutes, even while active.

Session lifetime
- Browser: UDS_SESSION kept its login-time Max-Age and was never re-issued,
  so the cookie vanished 30 min after login. Re-issue it on use (throttled
  by slidingInterval).
- Desktop: remote.mux WS traffic never passed the HTTP auth middleware, so
  the idle TTL never slid. assertPrincipalLive now reports activity and
  slides the session and the account's bridges (throttled).
- New setting sessionIdleTimeoutHours (Settings page + config). Default 0 =
  no automatic sign-out; only a manual sign-out ends a session, so
  conversations and night-time cron are never cut off. 0.5-168 enables an
  idle timeout with the 7-day cap. The TTL is read live.
- Stores support long TTLs: the absolute cap follows the TTL, older 7-day
  sessions are lifted on activity, and expiry timers re-arm instead of
  overflowing setTimeout (~24.8 days).

UAC token check
- Every 2 hours (and 1 min after start) each QR session's token is checked
  against icenterapi. A rejected token is only flagged, never a sign-out.
  Network errors, 5xx and bad JSON keep the previous verdict (the old 6h
  check revoked all of an account's sessions on any failure, including
  outages).
- GET /uds-auth/session-status (non-sliding) returns alive + tokenValid.
  The client probes it every minute and on focus: a gone session signs the
  UI out with a notice; a rejected token opens a refresh QR once.
- Scanning in refresh mode writes the new token into every live session of
  the account and the skill credential cache in place: no new session, no
  reload. Other accounts are rejected (token_refresh_emp_mismatch).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

uds-auth/lib/session/redis-store.js

@@ -1,5 +1,5 @@
 import { createHash, randomBytes } from 'node:crypto'
-import { SessionStore, SESSION_ABSOLUTE_MAX_SECONDS } from './store.js'
+import { SessionStore, absoluteCapSeconds } from './store.js'
 
 function hashBearer(bearer) {
   return createHash('sha256').update(String(bearer)).digest('hex')
@@ -48,7 +48,7 @@ export class RedisStore extends SessionStore {
       userData: { ...userData },
       createdAt: now,
       expiresAt: now + ttl * 1000,
-      absoluteExpiresAt: now + SESSION_ABSOLUTE_MAX_SECONDS * 1000,
+      absoluteExpiresAt: now + absoluteCapSeconds(ttl) * 1000,
     }
     const payload = JSON.stringify(record)
     await this._client.setEx(this._sessKey(sessionId), ttl, payload)
@@ -120,6 +120,9 @@ export class RedisStore extends SessionStore {
     const row = await this._load(sessionId)
     if (!row) return null
     const ttl = Math.max(60, Number(ttlSeconds) || 1800)
+    if (absoluteCapSeconds(ttl) > absoluteCapSeconds(0)) {
+      row.absoluteExpiresAt = Math.max(row.absoluteExpiresAt || 0, Date.now() + ttl * 1000)
+    }
     const absLeft = row.absoluteExpiresAt
       ? Math.max(0, Math.floor((row.absoluteExpiresAt - Date.now()) / 1000))
       : ttl
@@ -135,6 +138,16 @@ export class RedisStore extends SessionStore {
     return this._public(row)
   }
 
+  async updateUserData(sessionId, patch) {
+    const row = await this._load(sessionId)
+    if (!row) return null
+    const left = Math.floor((Number(row.expiresAt) - Date.now()) / 1000)
+    if (left <= 0) return null
+    row.userData = { ...row.userData, ...patch }
+    await this._client.setEx(this._sessKey(sessionId), left, JSON.stringify(row))
+    return this._public(row)
+  }
+
   async revokeSession(sessionId) {
     const row = await this._load(sessionId)
     if (!row) {