The server session slides its TTL on use but the browser cookie's Max-Age was frozen at login, so it lapsed mid-session and broke cookie-only auth (private image <img>/download loads returned 401) while the SPA still looked logged in via its Bearer token. Re-issue the cookie with a fresh Max-Age whenever an authenticated request carried it.
Full Go backend + Vue 3 frontend, OpenAI-compatible API, multi-provider
account pools, billing/admin, Docker one-command deploy with auto HTTPS.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
chiyi
