fix: configurable JWT TTL with working refresh endpoint (#800)

[lane711]

Summary

• Replace hardcoded 24h JWT expiration with configurable TTL (default 30d) via JWT_EXPIRES_IN env var or Admin → Settings → Security UI. Env var acts as a ceiling.
• Rewrite /auth/refresh to accept valid or recently-expired tokens within a configurable grace window (default 7d). Re-verifies HS256 via Web Crypto (hono/jwt checks exp before signature) and re-validates the user in the DB before issuing a new token.
• Wire every token-minting site (auth routes, OTP, magic-link, OAuth) through the DB-aware helper. Document the new surface in repo docs and on the doc site.

Fixes #800.

Changes

• packages/core/src/middleware/auth.ts — parseDuration, getJwtExpirySeconds, getJwtExpirySecondsFromDb, getJwtRefreshGraceSecondsFromDb, manual HS256 verify helper, grace-window support in verifyToken, configurable TTL in generateToken/setAuthCookie.
• packages/core/src/routes/auth.ts — removed hardcoded 24h TTLs, rewrote POST /auth/refresh with rate limit + grace window + DB re-validation, made setCsrfCookie DB-aware.
• packages/core/src/app.ts — added JWT_EXPIRES_IN and JWT_REFRESH_GRACE_SECONDS bindings.
• packages/core/src/middleware/index.ts — exported new helpers.
• packages/core/src/plugins/core-plugins/otp-login-plugin/index.ts, plugins/available/magic-link-auth/index.ts, plugins/core-plugins/oauth-providers/index.ts — switched to DB-aware TTL helper.
• packages/core/src/services/settings.ts — SecuritySettings interface, getSecuritySettings/saveSecuritySettings.
• packages/core/src/routes/admin-settings.ts — load persisted security settings, added validated POST /admin/settings/security.
• packages/core/src/templates/pages/admin-settings.template.ts — live Session / JWT card with TTL + grace inputs, new saveSecuritySettings() client handler.
• packages/core/src/__tests__/middleware/auth.test.ts — 8 new tests covering custom TTL, default TTL, grace accept/reject, bad-sig rejection within grace, and getJwtExpirySeconds duration parsing.
• docs/authentication.md, packages/core/src/plugins/core-plugins/otp-login-plugin/README.md, www/src/app/authentication/page.mdx — documentation updates.

Testing

• npm run type-check clean
• Auth middleware tests: 48/48 passing
• E2E tests (pending CI)

Checklist

• Code follows project conventions
• No new TypeScript errors introduced
• Tests added for new functionality (TTL config, grace window, bad-sig rejection)

🤖 Generated with Claude Code