fix: send QUIT notifications for background idle cleanup

The background idle cleanup (DeleteStaleUsers) was removing stale
clients/sessions directly via SQL without sending QUIT notifications
to channel members. This caused timed-out users to silently disappear
from channels.

Now runCleanup identifies sessions that will be orphaned by the stale
client deletion and calls cleanupUser for each one first, ensuring
QUIT messages are sent to all channel members — matching the explicit
logout behavior.

Also refactored cleanupUser to accept context.Context instead of
*http.Request so it can be called from both HTTP handlers and the
background cleanup goroutine.

internal/handlers/api.go

@@ -1405,7 +1405,7 @@ func (hdlr *Handlers) HandleLogout() http.HandlerFunc {
 
 		if remaining == 0 {
 			hdlr.cleanupUser(
-				request, sessionID, nick,
+				ctx, sessionID, nick,
 			)
 		}
 
@@ -1418,12 +1418,10 @@ func (hdlr *Handlers) HandleLogout() http.HandlerFunc {
 // cleanupUser parts the user from all channels (notifying
 // members) and deletes the session.
 func (hdlr *Handlers) cleanupUser(
-	request *http.Request,
+	ctx context.Context,
 	sessionID int64,
 	nick string,
 ) {
-	ctx := request.Context()
-
 	channels, _ := hdlr.params.Database.
 		GetSessionChannels(ctx, sessionID)
 

internal/handlers/handlers.go

@@ -169,6 +169,20 @@ func (hdlr *Handlers) runCleanup(
 ) {
 	cutoff := time.Now().Add(-timeout)
 
+	// Find sessions that will be orphaned so we can send
+	// QUIT notifications before deleting anything.
+	stale, err := hdlr.params.Database.
+		GetStaleOrphanSessions(ctx, cutoff)
+	if err != nil {
+		hdlr.log.Error(
+			"stale session lookup failed", "error", err,
+		)
+	}
+
+	for _, ss := range stale {
+		hdlr.cleanupUser(ctx, ss.ID, ss.Nick)
+	}
+
 	deleted, err := hdlr.params.Database.DeleteStaleUsers(
 		ctx, cutoff,
 	)