fix: extend session linger to 24 hours

[datasciencemonkey]

Summary

• Bumps SESSION_TIMEOUT_SECONDS from 300s (5 min) to 86400s (24 hours) — sessions linger defensively; active sessions live indefinitely via heartbeats, abandoned sessions get 24h before cleanup reaps them
• Bumps CLEANUP_INTERVAL_SECONDS from 60s to 900s (15 min) — less frequent sweeps since timeout window is much larger
• Closes slave FD after Popen to prevent FD leaks (os.close(slave_fd))
• Sets MAX_CONTENT_LENGTH = 32 MB aligned with Claude Code's 30 MB file limit
• Updates frontend comment to reflect new timeout
• Adds 10 tests covering timeout constants, session survival/reaping, warning thresholds, and health endpoint

Closes #76, fixes #78, fixes #79

How it works — defensive by design

Active sessions send heartbeats every 30s which reset the idle clock, so they live indefinitely. The 24-hour timeout only applies to abandoned sessions (user closed tab, lost connection). If no sessions are lingering, the cleanup thread wakes every 15 min, finds nothing, and goes back to sleep — zero overhead.

Test plan

• 10 new tests in tests/test_session_linger.py — all passing
• Existing test suite unaffected
• Security assessment v2 completed (5-agent parallel audit) — 0 FAILs, score 86/100
• Tested on Databricks Apps — functions as expected

[datasciencemonkey]

1. User closes tab → heartbeats stop
2. Last heartbeat timestamp freezes → idle clock starts ticking
3. Cleanup thread wakes every 15 min → checks now - last_poll_time
4. At ~19.2 hours (80%) → sets timeout_warning = True (returned on next heartbeat if they reconnect)
5. At 24 hours → session is reaped, PTY process killed

[datasciencemonkey]

Tested on Databricks Apps and things function as expected. Merging.