feat(auth): family-wide session constants + mint primitive + auth factory

Adds src/constants.ts exporting the family-wide session policy
(SESSION_TTL_DAYS=30, SESSION_TTL_SECONDS=2_592_000,
SESSION_RENEW_THRESHOLD_SECONDS=3600, LOGOUT_PATHS) so every
bchen.dev app shares the same persistence window.

Introduces issueSessionCookie as the single mint site for
fastify-jwt sign + setCookie, replacing inlined jwt.sign +
setCookie calls in pages.ts and api/v1/auth.ts. The cookie now
carries Max-Age=SESSION_TTL_SECONDS so it persists across browser
restarts.

Converts requireAuth into a makeRequireAuth(config) factory; route
plugins build their own preHandler at registration time. Threads
through pages.ts, api/v1/auth.ts, and api/v1/files.ts.

SESSION_COOKIE_NAME stays 'token' in this commit so existing tests
remain green; the rename to 'nanodrop_session' lands in a follow-up.
JWT_EXPIRY env var is still read; its removal also lands in a
follow-up so each commit builds cleanly.

src/routes/pages.ts

@@ -10,7 +10,8 @@ import type { LockoutService } from '../services/lockout.ts';
 import { createFile, getFileById, getFilesByUserId, deleteFile } from '../db/files.ts';
 import { saveFile, deleteStoredFile, getFilePath } from '../services/storage.ts';
 import { attemptLogin } from '../services/login-handler.ts';
-import { requireAuth, tokenCookieOptions } from '../middleware/auth.ts';
+import { makeRequireAuth, issueSessionCookie } from '../middleware/auth.ts';
+import { SESSION_COOKIE_NAME } from '../constants.ts';
 import { loginPage } from '../views/login.ts';
 import { uploadPage, uploadResultPage } from '../views/upload.ts';
 import { fileListPage } from '../views/file-list.ts';
@@ -49,6 +50,7 @@ function parseRangeHeader(header: string, fileSize: number): { start: number; en
 
 export const pageRoutes: FastifyPluginAsync<{ deps: Deps }> = async (app, { deps }) => {
   const { db, config, logger } = deps;
+  const requireAuth = makeRequireAuth(config);
   const loginRateLimit = {
     rateLimit: {
       max: config.loginRateLimitMax,
@@ -57,6 +59,7 @@ export const pageRoutes: FastifyPluginAsync<{ deps: Deps }> = async (app, { deps
   };
 
   // GET / — login page or redirect if authed
+  // opportunistic auth — does not slide the session; see middleware/session-renewal.ts
   app.get('/', async (request, reply) => {
     try {
       await request.jwtVerify();
@@ -91,17 +94,19 @@ export const pageRoutes: FastifyPluginAsync<{ deps: Deps }> = async (app, { deps
         return reply.type('text/html').send(loginPage({ error: 'Invalid username or password' }));
       }
 
-      const token = app.jwt.sign(
+      issueSessionCookie(
+        reply,
+        app,
         { sub: result.user.id, username: result.user.username },
-        { expiresIn: config.jwtExpiry },
+        config.cookieSecure,
       );
-      reply.setCookie('token', token, tokenCookieOptions(config.cookieSecure)).redirect('/upload');
+      reply.redirect('/upload');
     },
   );
 
   // POST /logout
   app.post('/logout', { preHandler: requireAuth }, async (_request, reply) => {
-    reply.clearCookie('token', { path: '/' }).redirect('/');
+    reply.clearCookie(SESSION_COOKIE_NAME, { path: '/' }).redirect('/');
   });
 
   // GET /upload
@@ -163,6 +168,7 @@ export const pageRoutes: FastifyPluginAsync<{ deps: Deps }> = async (app, { deps
   });
 
   // GET /f/:id — public file view (owner-aware)
+  // opportunistic auth — does not slide the session; see middleware/session-renewal.ts
   app.get<{ Params: { id: string } }>('/f/:id', async (request, reply) => {
     const { id } = request.params;