feat(auth): make automatic logout an opt-in per-user setting (#1536)

* feat(auth): make automatic logout an opt-in per-user setting

Session timeouts (30 min idle / 12 h absolute on hosted) now apply only
to users who enable "Automatic logout" in Settings > Security. Default
is off: sessions live for the full Supabase refresh-token lifetime, the
behavior from before the 2026-07 session hardening.

- user_preferences.auto_logout (migration, default false), toggled via
  the extended /api/user/preferences route
- The opt-in is snapshotted into the signed timeout cookie at mint, so
  enforcement stays DB-read-free per request; the preferences route
  clears the cookie on change so a toggle takes effect immediately
- Pre-toggle cookies are authentic-but-stale: re-minted preserving
  their timers, never routed down the tamper path, so the rollout does
  not log anyone out
- NEXT_PUBLIC_SESSION_TIMEOUT_FORCE_ALL=true enforces timeouts for
  every user regardless of preference (emergency lever, also plumbed
  through the Docker image); self-hosted stays disabled by default

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(auth): resolve PR #1536 review findings

- Replace the spread upsert in /api/user/preferences with one literal
  payload per field: the phantom-column schema guard cannot resolve
  spread payloads (Unit tests 3/4 ceiling failure)
- Map the preferences 500 through getErrorMessage so the user-facing
  text is Swedish (CodeRabbit)
- fetchAutoLogoutPreference now returns null on a FAILED read instead
  of a fail-open false: callers skip minting so an unknown preference
  is never persisted into the year-long signed cookie, and the next
  request retries; failures log at error level, distinct from the
  normal opt-out path (compliance swarm GDPR Art.32(1)(b) / ISO A.8.5)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(auth): write multi-field preference updates as one atomic upsert

A request carrying both hide_assistant_fab and auto_logout previously
issued two sequential writes, so a failure of the second returned 500
after half the request had persisted (CodeRabbit, PR #1536). One
literal upsert per accepted field combination keeps the write atomic
and stays resolvable for the phantom-column schema guard.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

.env.example

@@ -25,14 +25,20 @@ RECEIPT_HUNT_MODEL_ID=
 RECEIPT_HUNT_MIN_CONFIDENCE=
 RECEIPT_HUNT_COMPANY_IDS=
 
-# Hosted session security defaults: 30 minutes idle, 12 hours absolute,
-# with a warning 2 minutes before expiry. Set a timeout to 0 to disable that
-# limit. Self-hosted deployments default both limits to 0 unless overridden.
+# Session timeouts are opt-in per user (user_preferences.auto_logout, toggled
+# in Settings > Security): users who have not opted in stay signed in for the
+# full Supabase session lifetime. The variables below set the limits that
+# apply to opted-in users: 30 minutes idle, 12 hours absolute, warning 2
+# minutes before expiry. Set a timeout to 0 to disable that limit entirely.
+# Self-hosted deployments default both limits to 0 unless overridden.
+# NEXT_PUBLIC_SESSION_TIMEOUT_FORCE_ALL=true enforces the timeouts for every
+# user regardless of their preference (emergency lever / strict deployments).
 # The signing key falls back to SUPABASE_SERVICE_ROLE_KEY; set a dedicated
 # random secret if session signing should rotate independently.
 # NEXT_PUBLIC_SESSION_IDLE_TIMEOUT_MS=1800000
 # NEXT_PUBLIC_SESSION_ABSOLUTE_TIMEOUT_MS=43200000
 # NEXT_PUBLIC_SESSION_WARNING_MS=120000
+# NEXT_PUBLIC_SESSION_TIMEOUT_FORCE_ALL=false
 # SESSION_TIMEOUT_SECRET=
 
 # Self-hosted only: set to true when public signup is turned off in your