fix(uds-auth): keep sessions until manual sign-out; refresh expired UAC tokens by QR (0.3.20)

Users were asked to sign in again every ~30 minutes, even while active.

Session lifetime
- Browser: UDS_SESSION kept its login-time Max-Age and was never re-issued,
  so the cookie vanished 30 min after login. Re-issue it on use (throttled
  by slidingInterval).
- Desktop: remote.mux WS traffic never passed the HTTP auth middleware, so
  the idle TTL never slid. assertPrincipalLive now reports activity and
  slides the session and the account's bridges (throttled).
- New setting sessionIdleTimeoutHours (Settings page + config). Default 0 =
  no automatic sign-out; only a manual sign-out ends a session, so
  conversations and night-time cron are never cut off. 0.5-168 enables an
  idle timeout with the 7-day cap. The TTL is read live.
- Stores support long TTLs: the absolute cap follows the TTL, older 7-day
  sessions are lifted on activity, and expiry timers re-arm instead of
  overflowing setTimeout (~24.8 days).

UAC token check
- Every 2 hours (and 1 min after start) each QR session's token is checked
  against icenterapi. A rejected token is only flagged, never a sign-out.
  Network errors, 5xx and bad JSON keep the previous verdict (the old 6h
  check revoked all of an account's sessions on any failure, including
  outages).
- GET /uds-auth/session-status (non-sliding) returns alive + tokenValid.
  The client probes it every minute and on focus: a gone session signs the
  UI out with a notice; a rejected token opens a refresh QR once.
- Scanning in refresh mode writes the new token into every live session of
  the account and the skill credential cache in place: no new session, no
  reload. Other accounts are rejected (token_refresh_emp_mismatch).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

uds-auth/lib/session/store.js

@@ -36,6 +36,11 @@ export class SessionStore {
     throw new Error('SessionStore#touch must be implemented')
   }
 
+  /** Merge fields into a live session's userData (e.g. a refreshed UAC token). */
+  async updateUserData(sessionId, patch) {
+    throw new Error('SessionStore#updateUserData must be implemented')
+  }
+
   async revokeSession(sessionId) {
     throw new Error('SessionStore#revokeSession must be implemented')
   }
@@ -92,3 +97,11 @@ export const SESSION_COOKIE = 'UDS_SESSION'
 export const SESSION_HEADER = 'x-uds-session'
 /** Absolute session lifetime; idle expiry (cookieMaxAge) slides within it. */
 export const SESSION_ABSOLUTE_MAX_SECONDS = 7 * 24 * 60 * 60
+
+/**
+ * Absolute lifetime for a session with this idle TTL. A TTL above 7 days means
+ * "no automatic sign-out" (sessionIdleTimeoutHours = 0), so the cap follows the TTL.
+ */
+export function absoluteCapSeconds(ttlSeconds) {
+  return Math.max(SESSION_ABSOLUTE_MAX_SECONDS, Number(ttlSeconds) || 0)
+}