Add inactivity-based session timeout (closes #66) (#105)

Sessions now carry a server-enforced idle deadline (SESSION_IDLE_TIMEOUT,
default 24h) alongside the 7-day absolute cap, refreshed on authenticated
activity. Activity never extends the absolute cap.

internal/config/config_test.go

@@ -163,7 +163,7 @@ func TestRetentionSweepInterval(t *testing.T) {
 			}
 
 			if tt.expectError {
-				testRetentionSweepIntervalError(t)
+				expectStartupError(t)
 			} else {
 				testRetentionSweepIntervalSuccess(t, tt.expected)
 			}
@@ -171,7 +171,9 @@ func TestRetentionSweepInterval(t *testing.T) {
 	}
 }
 
-func testRetentionSweepIntervalError(t *testing.T) {
+// expectStartupError asserts that fx refuses to build the app,
+// which is what a set-but-unparseable duration must cause.
+func expectStartupError(t *testing.T) {
 	t.Helper()
 
 	var cfg *config.Config
@@ -215,6 +217,82 @@ func testRetentionSweepIntervalSuccess(
 	assert.Equal(t, expected, cfg.RetentionSweepInterval)
 }
 
+func TestSessionIdleTimeout(t *testing.T) {
+	tests := []struct {
+		name        string
+		set         bool
+		value       string
+		expectError bool
+		expected    time.Duration
+	}{
+		{
+			name:     "unset uses default",
+			set:      false,
+			expected: 24 * time.Hour,
+		},
+		{
+			name:     "valid value is parsed",
+			set:      true,
+			value:    "30m",
+			expected: 30 * time.Minute,
+		},
+		{
+			name:        "unparseable value fails startup",
+			set:         true,
+			value:       "not-a-duration",
+			expectError: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Cannot use t.Parallel() here because t.Setenv
+			// is incompatible with parallel subtests.
+			t.Setenv("WEBHOOKER_ENVIRONMENT", "dev")
+
+			if tt.set {
+				t.Setenv("SESSION_IDLE_TIMEOUT", tt.value)
+			} else {
+				require.NoError(t, os.Unsetenv(
+					"SESSION_IDLE_TIMEOUT",
+				))
+			}
+
+			if tt.expectError {
+				expectStartupError(t)
+			} else {
+				testSessionIdleTimeoutSuccess(t, tt.expected)
+			}
+		})
+	}
+}
+
+func testSessionIdleTimeoutSuccess(
+	t *testing.T,
+	expected time.Duration,
+) {
+	t.Helper()
+
+	var cfg *config.Config
+
+	app := fxtest.New(
+		t,
+		fx.Provide(
+			globals.New,
+			logger.New,
+			config.New,
+		),
+		fx.Populate(&cfg),
+	)
+	require.NoError(t, app.Err())
+
+	app.RequireStart()
+
+	defer app.RequireStop()
+
+	assert.Equal(t, expected, cfg.SessionIdleTimeout)
+}
+
 func TestDefaultDataDir(t *testing.T) {
 	for _, env := range []string{"", "dev", "prod"} {
 		name := env