Add inactivity-based session timeout (closes #66) (#105)

Sessions now carry a server-enforced idle deadline (SESSION_IDLE_TIMEOUT,
default 24h) alongside the 7-day absolute cap, refreshed on authenticated
activity. Activity never extends the absolute cap.

internal/config/config.go

@@ -31,6 +31,10 @@ const (
 	// reaper deletes events older than each webhook's RetentionDays.
 	defaultRetentionSweepInterval = time.Hour
 
+	// defaultSessionIdleTimeout is how long a session may go without
+	// authenticated activity before it expires.
+	defaultSessionIdleTimeout = 24 * time.Hour
+
 	// maxPort is the highest valid TCP port number. The lower
 	// bound (at least 1) is enforced by envPositiveInt.
 	maxPort = 65535
@@ -71,6 +75,10 @@ type Config struct {
 	// RetentionSweepInterval is how often the retention reaper runs.
 	RetentionSweepInterval time.Duration
 
+	// SessionIdleTimeout is the sliding inactivity window after
+	// which a session expires. Non-positive disables idle expiry.
+	SessionIdleTimeout time.Duration
+
 	params *ConfigParams
 	log    *slog.Logger
 }
@@ -247,6 +255,14 @@ func loadFromEnv() (*Config, error) {
 		return nil, err
 	}
 
+	sessionIdleTimeout, err := envDuration(
+		"SESSION_IDLE_TIMEOUT",
+		defaultSessionIdleTimeout,
+	)
+	if err != nil {
+		return nil, err
+	}
+
 	return &Config{
 		DataDir:                envString("DATA_DIR"),
 		Debug:                  debug,
@@ -257,6 +273,7 @@ func loadFromEnv() (*Config, error) {
 		Port:                   port,
 		SentryDSN:              envString("SENTRY_DSN"),
 		RetentionSweepInterval: retentionSweepInterval,
+		SessionIdleTimeout:     sessionIdleTimeout,
 	}, nil
 }