Keep active IRC listener users from expiring (closes #121)

Every command a registered IRC listener client sends, PING and PONG
included, now sets last_seen on its session and its client, so the
idle cleanup no longer removes an IRC user who is still active; one
who sends nothing for SESSION_IDLE_TIMEOUT is still removed. The two
UPDATEs that GetSessionByToken ran for every authenticated HTTP API
request move into UpdateLastSeen, which both transports now call. The
IRC listener refreshes on every command, with no interval between
writes: that is what every HTTP API request already costs. README.md
describes last_seen to match.

Model: opus-5-5
Co-authored-by: clawbot <sneak+clawbot@sneak.cloud>

internal/ircserver/server_test.go

@@ -369,6 +369,39 @@ func TestPingPong(t *testing.T) {
 	assertContains(t, lines, "PONG", "PONG response")
 }
 
+// TestIdleCleanupKeepsActiveUser checks that a user who
+// sends commands is kept by the idle cleanup, and a user who
+// sends nothing is not.
+func TestIdleCleanupKeepsActiveUser(t *testing.T) {
+	t.Parallel()
+
+	const idleTimeout = 500 * time.Millisecond
+
+	env := newTestEnv(t)
+
+	active := env.dial(t)
+	active.register("active")
+
+	idle := env.dial(t)
+	idle.register("idle")
+
+	time.Sleep(idleTimeout)
+	active.sendAndExpect("PING :still here", "PONG")
+
+	// The idle cleanup in internal/handlers removes exactly
+	// the users this returns.
+	stale, err := env.database.GetStaleOrphanSessions(
+		t.Context(), time.Now().Add(-idleTimeout),
+	)
+	if err != nil {
+		t.Fatalf("get stale sessions: %v", err)
+	}
+
+	if len(stale) != 1 || stale[0].Nick != "idle" {
+		t.Errorf("cleanup removes %v, want only idle", stale)
+	}
+}
+
 func TestJoinChannel(t *testing.T) {
 	t.Parallel()