feat: real, admin-configurable session timeout + cookie hardening (B4)

[ball42]

Makes the console session timeout real and admin-configurable, and hardens session cookies (internal ref J6 / B4). Verified against the smoke harness.

B4 — the 15-minute timeout was never enforced

permanent_session_lifetime was set but session.permanent was never set, so Flask never applied the lifetime — the sliding-window heartbeat pushed against a limit that didn't govern, and the timeout-warning modal advertised a window the server didn't enforce.

• Set session.permanent = True on login success so the lifetime actually governs.
• before_request now resolves the configured timeout each request and applies it (change takes effect with no restart).
• Session cookies hardened: Secure, HttpOnly, SameSite=Lax.

New — admin-configurable timeout

Setup now offers a session-timeout dropdown: 15 minutes (default) / 1 hour / 4 hours / 8 hours, stored in server.json. This addresses reports of getting logged out mid-workflow-testing (lining up devices, enrolling, monitoring Jamf takes time) without weakening the default.

• The 15-minute default is unchanged and remains the most secure option.
• The 4h/8h tiers are labeled Extended with inline security-trade-off copy — a signed-in console left unattended is exposed for longer, so the choice is deliberate.
• No "never expire" option (deliberately excluded — poor posture on a console that can push automations).
• Fail-safe: any missing, malformed, off-ladder, or non-object server.json resolves to 15 minutes — never longer. A hand-edited/corrupt config can never open a longer window or crash the console.

Modal accuracy

The timeout-warning modal now counts down against the effective configured timeout (server-injected), so it never advertises a window the server doesn't enforce.

Tests

New tests/test_session.py: ladder resolution + fail-safe (incl. bools/floats/non-dict config), enforcement, cookie flags, /setup round-trip + off-ladder clamp, and the modal's injected value. Full suite green (78 passed, 2 xfailed), ruff clean.

Notes

• The extended tiers are a deliberate, admin-labeled trade-off — documented so the posture isn't "fixed" blind later.
• Per-boot secret key still caps effective session lifetime at the next restart regardless of setting (unchanged; out of scope).
• Targets develop for the batched v3.2 release.