Align session codec max-age with the 7-day cap (closes #108)

sessions.NewCookieStore gives its securecookie codecs a 30-day max
age, and assigning store.Options never touches Codecs. The store
therefore decoded a cookie up to 30 days old while the cookie
attribute and the server-side expiry check both said 7 days, so a
refactor of that check -- or a second decode path that skips
IsAuthenticated -- would silently reopen a 30-day window.

Build the store through store.MaxAge, which sets Options.MaxAge and
propagates to every codec. The store is now built by newStore, the
one place a store is constructed; Regenerate shares its cookie
attributes via cookieOptions.

Tests:

- Two codec tests decode a re-stamped cookie a hour inside and an
  hour outside the cap. They only exercise Session.Get, so they pin
  the codec: reverting the fix fails the rejection test whether or
  not the server-side expiry check is present.
- The lazy-refresh bound is pinned two-sidedly, so the documented
  "expires up to 10% early, never late" guarantee now fails the
  suite if idleRefreshDivisor drifts in either direction.

Also fixes the RequireAuth save error, which was assigned to the
outer err and is now scoped to the branch that produces it, and two
README claims: the idle timeout is disabled by any non-positive
value, not only 0, and deploying the two-clock expiry logs existing
sessions out once because they carry no timestamps.

#108

internal/middleware/middleware.go

@@ -214,11 +214,11 @@ func (s *Middleware) RequireAuth() func(http.Handler) http.Handler {
 			// handler runs, while the headers are still ours to
 			// write.
 			if s.session.Touch(sess) {
-				err = s.session.Save(r, w, sess)
-				if err != nil {
+				saveErr := s.session.Save(r, w, sess)
+				if saveErr != nil {
 					s.log.Error(
 						"auth middleware: failed to refresh session",
-						"error", err,
+						"error", saveErr,
 					)
 				}
 			}