refactor: drop redundant iat intersections and reuse JwtPayload in tests

JwtPayload already declares iat?: number, so the & { iat?: number } in
makeRequireAuth and slideSessionIfNeeded was a no-op. The unit test had a
local TestPayload duplicating the same shape — replaced with the canonical
import.

src/middleware/auth.ts

@@ -33,7 +33,7 @@ export function issueSessionCookie(
 export function makeRequireAuth(config: Config) {
   return async function requireAuth(request: FastifyRequest, reply: FastifyReply): Promise<void> {
     try {
-      const payload = await request.jwtVerify<JwtPayload & { iat?: number }>();
+      const payload = await request.jwtVerify<JwtPayload>();
       slideSessionIfNeeded(request, reply, payload, request.server, config.cookieSecure);
     } catch {
       const isApi = request.url.startsWith('/api/');

src/middleware/session-renewal.ts

@@ -7,7 +7,7 @@ import { issueSessionCookie } from './auth.ts';
 export function slideSessionIfNeeded(
   request: FastifyRequest,
   reply: FastifyReply,
-  payload: JwtPayload & { iat?: number },
+  payload: JwtPayload,
   server: FastifyInstance,
   cookieSecure: boolean,
 ): void {