fix(uds-auth): keep sessions until manual sign-out; refresh expired UAC tokens by QR (0.3.20)

Users were asked to sign in again every ~30 minutes, even while active.

Session lifetime
- Browser: UDS_SESSION kept its login-time Max-Age and was never re-issued,
  so the cookie vanished 30 min after login. Re-issue it on use (throttled
  by slidingInterval).
- Desktop: remote.mux WS traffic never passed the HTTP auth middleware, so
  the idle TTL never slid. assertPrincipalLive now reports activity and
  slides the session and the account's bridges (throttled).
- New setting sessionIdleTimeoutHours (Settings page + config). Default 0 =
  no automatic sign-out; only a manual sign-out ends a session, so
  conversations and night-time cron are never cut off. 0.5-168 enables an
  idle timeout with the 7-day cap. The TTL is read live.
- Stores support long TTLs: the absolute cap follows the TTL, older 7-day
  sessions are lifted on activity, and expiry timers re-arm instead of
  overflowing setTimeout (~24.8 days).

UAC token check
- Every 2 hours (and 1 min after start) each QR session's token is checked
  against icenterapi. A rejected token is only flagged, never a sign-out.
  Network errors, 5xx and bad JSON keep the previous verdict (the old 6h
  check revoked all of an account's sessions on any failure, including
  outages).
- GET /uds-auth/session-status (non-sliding) returns alive + tokenValid.
  The client probes it every minute and on focus: a gone session signs the
  UI out with a notice; a rejected token opens a refresh QR once.
- Scanning in refresh mode writes the new token into every live session of
  the account and the skill credential cache in place: no new session, no
  reload. Other accounts are rejected (token_refresh_emp_mismatch).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

uds-auth/lib/session-bridge.js

@@ -157,6 +157,21 @@ export class SessionBridgeStore {
     return true
   }
 
+  /**
+   * Slide every live bridge of an empNo. Used when activity arrives over the WS mux,
+   * where only the sessionId (not the bearer) is known. Safe: a bridge only carries
+   * the bearer — the session store still decides whether it authenticates.
+   * @param {string} empNo
+   * @param {number} [ttlMs]
+   */
+  touchEmpNo(empNo, ttlMs) {
+    const e = String(empNo || '').trim()
+    if (!e) return
+    for (const [token, row] of this._byToken) {
+      if (row.empNo === e) this.touch(token, ttlMs)
+    }
+  }
+
   /** Clear all bridge tokens for an empNo (logout). */
   revokeEmpNo(empNo) {
     const e = String(empNo || '').trim()