feat(auth): make automatic logout an opt-in per-user setting (#1536)

* feat(auth): make automatic logout an opt-in per-user setting

Session timeouts (30 min idle / 12 h absolute on hosted) now apply only
to users who enable "Automatic logout" in Settings > Security. Default
is off: sessions live for the full Supabase refresh-token lifetime, the
behavior from before the 2026-07 session hardening.

- user_preferences.auto_logout (migration, default false), toggled via
  the extended /api/user/preferences route
- The opt-in is snapshotted into the signed timeout cookie at mint, so
  enforcement stays DB-read-free per request; the preferences route
  clears the cookie on change so a toggle takes effect immediately
- Pre-toggle cookies are authentic-but-stale: re-minted preserving
  their timers, never routed down the tamper path, so the rollout does
  not log anyone out
- NEXT_PUBLIC_SESSION_TIMEOUT_FORCE_ALL=true enforces timeouts for
  every user regardless of preference (emergency lever, also plumbed
  through the Docker image); self-hosted stays disabled by default

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(auth): resolve PR #1536 review findings

- Replace the spread upsert in /api/user/preferences with one literal
  payload per field: the phantom-column schema guard cannot resolve
  spread payloads (Unit tests 3/4 ceiling failure)
- Map the preferences 500 through getErrorMessage so the user-facing
  text is Swedish (CodeRabbit)
- fetchAutoLogoutPreference now returns null on a FAILED read instead
  of a fail-open false: callers skip minting so an unknown preference
  is never persisted into the year-long signed cookie, and the next
  request retries; failures log at error level, distinct from the
  normal opt-out path (compliance swarm GDPR Art.32(1)(b) / ISO A.8.5)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(auth): write multi-field preference updates as one atomic upsert

A request carrying both hide_assistant_fab and auto_logout previously
issued two sequential writes, so a failure of the second returned 500
after half the request had persisted (CodeRabbit, PR #1536). One
literal upsert per accepted field combination keeps the write atomic
and stays resolvable for the phantom-column schema guard.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

docs/SELF-HOSTING.md

@@ -93,9 +93,12 @@ CRON_SECRET=<generate with: openssl rand -hex 32>
 
 `NEXT_PUBLIC_APP_URL` must match your public-facing URL. It is used in invoice reminder emails, calendar feed links, and PSD2 callbacks. If left as a placeholder, links will be broken.
 
-Hosted Accounted sessions default to a 30-minute idle limit, a 12-hour absolute
-limit, and a warning 2 minutes before expiry. Self-hosted installations leave
-both limits disabled unless you opt in (values are milliseconds):
+Automatic logout is opt-in per user: sessions only expire for users who have
+enabled "Automatic logout" in Settings > Security (stored on
+`user_preferences.auto_logout`, default off). For opted-in users, hosted
+Accounted defaults to a 30-minute idle limit, a 12-hour absolute limit, and a
+warning 2 minutes before expiry. Self-hosted installations leave both limits
+disabled unless you opt in (values are milliseconds):
 
 ```bash
 NEXT_PUBLIC_SESSION_IDLE_TIMEOUT_MS=1800000
@@ -103,7 +106,15 @@ NEXT_PUBLIC_SESSION_ABSOLUTE_TIMEOUT_MS=43200000
 NEXT_PUBLIC_SESSION_WARNING_MS=120000
 ```
 
-Set either timeout to `0` to disable only that limit. Timeout state is signed
+Set either timeout to `0` to disable only that limit. To enforce the timeouts
+for every user regardless of their per-user preference (the pre-2026-08
+behavior), also set:
+
+```bash
+NEXT_PUBLIC_SESSION_TIMEOUT_FORCE_ALL=true
+```
+
+Timeout state is signed
 with `SUPABASE_SERVICE_ROLE_KEY` by default; set `SESSION_TIMEOUT_SECRET` to a
 separate random value if you want to rotate it independently. Changing either
 signing secret invalidates existing timeout cookies and requires users to sign