v2.1.3

fix: reset IdP session idle timeout on token refresh (#376) (#377)

The idle sweeper was measuring inactivity from the original login
rather than from the last token use, causing cascade revocation of
sessions with active refresh-token clients. Call UpdateLastActivity
in the refresh_token grant path so the idle clock resets on each
refresh, matching the behavior of Keycloak, Auth0, and Azure AD.

Also documents the per-client sso_session_idle_timeout limitation:
the cleanup sweep only reads the global value.

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>