fix(auth): roll session cookie Max-Age on each authed request

The server session slides its TTL on use but the browser cookie's Max-Age was frozen at login, so it lapsed mid-session and broke cookie-only auth (private image <img>/download loads returned 401) while the SPA still looked logged in via its Bearer token. Re-issue the cookie with a fresh Max-Age whenever an authenticated request carried it.

backend/internal/http/router/router.go

@@ -81,7 +81,7 @@ func New(cfg *config.Config, auth *service.AuthService, handlers Handlers) *gin.
 	}
 
 	userAuthed := engine.Group("/admin/api")
-	userAuthed.Use(middleware.RequireSession(auth))
+	userAuthed.Use(middleware.RequireSession(auth, cfg))
 	{
 		userAuthed.GET("/logs", handlers.UserGen.Logs)
 		userAuthed.POST("/generate", handlers.UserGen.Generate)
@@ -99,7 +99,7 @@ func New(cfg *config.Config, auth *service.AuthService, handlers Handlers) *gin.
 	}
 
 	authed := engine.Group("/admin/api")
-	authed.Use(middleware.RequireAdminSession(auth))
+	authed.Use(middleware.RequireAdminSession(auth, cfg))
 	{
 		authed.GET("/dashboard", handlers.AdminRead.Dashboard)
 		authed.GET("/users", handlers.AdminRead.Users)
@@ -186,7 +186,7 @@ func New(cfg *config.Config, auth *service.AuthService, handlers Handlers) *gin.
 		}
 	}
 
-	authGroup.Use(middleware.RequireSession(auth))
+	authGroup.Use(middleware.RequireSession(auth, cfg))
 	{
 		authGroup.GET("/me", handlers.Auth.Me)
 		authGroup.GET("/invites", handlers.Auth.Invites)