Sessions lived in an in-memory array, so every daemon restart wiped them
and forced a re-login. Move them into the webui DB:
- New sessions table storing a SHA-256 of the bearer token (never the
raw token, so a DB read can't be replayed), the user, role, and an
absolute expiry.
- create/lookup/touch/delete + per-user delete + prune in webui_store.
- Login persists the session; auth checks validate against the DB with a
throttled sliding expiry (re-extended at most hourly to avoid a write
per request); logout and admin reset/delete drop the rows. Expired
rows are reaped lazily on lookup and pruned at startup.
- TTL is configurable via NAUT_SESSION_TTL (default 7 days) and drives
the cookie Max-Age. Removes the in-memory session array + auth_lock.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
067b62c23a