The remote-login session fix capped EVERY session at shortLived.ttlMs, so opening
a persistent link gave a 15-minute session. That is wrong for the link type an
operator uses for their own devices — persistent means the link keeps working.
Session lifetime now follows the token type:
short-lived -> never outlives the token that authorised it (falls back to the
configured TTL when there is no usable expiry, and an already
expired token does not fall through to the long one)
persistent -> a long session (30 days), because the link itself never expires
It is still a SESSION rather than the daemon token — opaque, revocable, and gone
on restart — so the leak this all started from stays fixed: a recipient never
receives the dashboard's permanent credential.
Moved the rule out of server.ts into remote-session.ts so it is unit-tested
rather than living inline in a request handler. 15 tests pass.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
4c545676b8