fix(uds-auth): keep sessions until manual sign-out; refresh expired UAC tokens by QR (0.3.20)

Users were asked to sign in again every ~30 minutes, even while active.

Session lifetime
- Browser: UDS_SESSION kept its login-time Max-Age and was never re-issued,
  so the cookie vanished 30 min after login. Re-issue it on use (throttled
  by slidingInterval).
- Desktop: remote.mux WS traffic never passed the HTTP auth middleware, so
  the idle TTL never slid. assertPrincipalLive now reports activity and
  slides the session and the account's bridges (throttled).
- New setting sessionIdleTimeoutHours (Settings page + config). Default 0 =
  no automatic sign-out; only a manual sign-out ends a session, so
  conversations and night-time cron are never cut off. 0.5-168 enables an
  idle timeout with the 7-day cap. The TTL is read live.
- Stores support long TTLs: the absolute cap follows the TTL, older 7-day
  sessions are lifted on activity, and expiry timers re-arm instead of
  overflowing setTimeout (~24.8 days).

UAC token check
- Every 2 hours (and 1 min after start) each QR session's token is checked
  against icenterapi. A rejected token is only flagged, never a sign-out.
  Network errors, 5xx and bad JSON keep the previous verdict (the old 6h
  check revoked all of an account's sessions on any failure, including
  outages).
- GET /uds-auth/session-status (non-sliding) returns alive + tokenValid.
  The client probes it every minute and on focus: a gone session signs the
  UI out with a notice; a rejected token opens a refresh QR once.
- Scanning in refresh mode writes the new token into every live session of
  the account and the skill credential cache in place: no new session, no
  reload. Other accounts are rejected (token_refresh_emp_mismatch).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

uds-auth/test/emergency-workspace-follow.test.js

@@ -351,3 +351,42 @@ test('anonymous stream endpoints are parked until the carrier aborts (no termina
   for await (const f of authed.method()) frames.push(f)
   assert.deepEqual(frames, [{ status: 'credential-stored' }])
 })
+
+test('WS activity (assertPrincipalLive) reports the live session so its idle TTL slides', async () => {
+  const stores = makeStores()
+  const [, kind, ctxOf] = EMERGENCY_LOGINS[0]
+  const { bearer } = await login(stores, ctxOf(), kind)
+  const session = await stores.sessionStore.getByBearer(bearer)
+  const seen = []
+  const noop = async () => {}
+  const wc = {
+    create: noop, rename: noop, delete: noop, insertBefore: noop, insertSessionBefore: noop,
+    archiveSession: noop, unarchiveSession: noop, pinSession: noop, unpinSession: noop,
+    async *follow() { yield { type: 'baseline', value: { items: [], archivedSessionIds: [], pinnedSessionIds: [] } } },
+  }
+  installDshAcl({
+    inject(deps, cb) { if (deps.includes('workspaceController')) cb({ workspaceController: wc }) },
+    on() { return () => {} },
+    get() { throw new Error('no service') },
+  }, {
+    sessionAcl: { getOwner: () => null, setOwner() {} },
+    userWorkspaces: new UserWorkspaceStore({}),
+    getWorkspaceRoot: () => '',
+    getRolesStore: () => stores.roles,
+    getSessionStore: () => stores.sessionStore,
+    ensureUserWorkspace: async () => ({ workspaceId: 'ws-admin' }),
+    getWorkspaceRegistry: () => ({ list: () => [], get: () => null }),
+    onPrincipalActive: (sid, emp) => seen.push([sid, emp]),
+  })
+  await collect(wc, identityFromSessionRecord(session, stores.roles))
+  assert.deepEqual(seen[0], [session.sessionId, 'administrator'])
+})
+
+test('SessionBridgeStore.touchEmpNo slides every live bridge of that account only', () => {
+  const store = new SessionBridgeStore({ ttlMs: 60_000 })
+  const a = store.mint({ empNo: 'alice', kind: 'uds' })
+  const b = store.mint({ empNo: 'bob', kind: 'uds' })
+  store.touchEmpNo('alice', 10 * 60_000)
+  assert.ok(store._byToken.get(a.token).exp > Date.now() + 5 * 60_000)
+  assert.ok(store._byToken.get(b.token).exp <= Date.now() + 60_000)
+})