persistentCookie on instantiateUserSession and promoteToSession, and
persistentSessionCookie on the webauthn block, give the session cookie a
Max-Age equal to the session length so a sign-in survives browser restarts.
Without them the cookie still ends with the browser. Release 0.93.0.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>