Sessions survive deploys, 12-hour idle timeout (#194)

[aleksejs1]

Closes #194, part of #213.

What changes

• Sessions survive a redeploy. Session files move from PHP's default (the container's own tmp, lost on every recreate) to var/sessions, inside the /app/var volume every topology mounts. Not var/cache, which the deploy step deletes.
• 12-hour idle timeout. AuthSession stamps last_active_at on login and on every authenticated request, and ends a login idle for more than IDLE_TIMEOUT_SECONDS. A logged-in session with no stamp counts as idle.
• An idle logout drops the login, not the session. The check runs in CompanyFilterListener, before the CSRF listener; invalidating the session there made an idle tab's first write fail with 403 "invalid CSRF token", which the client doesn't treat as a logout. Found in review round 1.
• gc_maxlifetime is 48 hours, disk cleanup only. cookie_lifetime stays 0.

No migration, no frontend change.

Verification

• make verify-pr-ready passes (808 backend tests, lint, mutation).
• New tests with a mocked clock: rejected past the timeout and stays rejected, exactly 12h still valid, each request restarts the window, the live-state poll alone keeps a session alive, re-login after an idle logout, and 401 (not 403) for a write sent with the CSRF token an idle tab still holds.
• Dev stack: a real session returned 200 from /api/me before and after docker compose up -d --force-recreate; with last_active_at set 12h 5s back it returned 401.
• Two code-review rounds; the second came back with nothing that held up.

Not done

• Production check from the issue's first acceptance criterion: only possible after the deploy.
• The deploy that first ships this signs everyone out one more time (old sessions are in the old container's tmp).
• The live-update poll pauses in a hidden tab, so a background tab idle for 12 hours is logged out. Not changed here.

See docs/decisions/2026-10-03-sessions-survive-deploys-idle-timeout.md.

🤖 Generated with Claude Code