Add inactivity-based session timeout (closes #66) (#105)

Sessions now carry a server-enforced idle deadline (SESSION_IDLE_TIMEOUT,
default 24h) alongside the 7-day absolute cap, refreshed on authenticated
activity. Activity never extends the absolute cap.

internal/session/testing.go

@@ -2,6 +2,7 @@ package session
 
 import (
 	"log/slog"
+	"time"
 
 	"github.com/gorilla/sessions"
 	"sneak.berlin/go/webhooker/internal/config"
@@ -12,16 +13,28 @@ import (
 // middleware and handler tests to use real session functionality. The key
 // parameter is the raw 32-byte authentication key used for session encryption
 // and CSRF cookie signing.
+//
+// The idle timeout is taken from cfg.SessionIdleTimeout, exactly as in
+// production. The now parameter supplies the clock used for expiry
+// checks so tests can advance time without sleeping; pass nil for the
+// real clock.
 func NewForTest(
 	store *sessions.CookieStore,
 	cfg *config.Config,
 	log *slog.Logger,
 	key []byte,
+	now func() time.Time,
 ) *Session {
+	if now == nil {
+		now = time.Now
+	}
+
 	return &Session{
-		store:  store,
-		key:    key,
-		config: cfg,
-		log:    log,
+		store:       store,
+		key:         key,
+		config:      cfg,
+		log:         log,
+		idleTimeout: cfg.SessionIdleTimeout,
+		now:         now,
 	}
 }