feat(auth): 后台登录改为滑动会话

- JWT 记录 iat，exp=min(now+24h, iat+7d)
- 已认证请求自动续签 httpOnly Cookie
- 新增 ACCESS_TOKEN_IDLE_HOURS / ACCESS_TOKEN_MAX_HOURS

web/backend/main.py

@@ -36,6 +36,7 @@ from .routers import (
     yyb,
 )
 from .schemas import AppInfo
+from .session import SessionRenewalMiddleware
 from .version import get_app_version
 
 
@@ -149,6 +150,9 @@ class SecurityHeadersMiddleware(BaseHTTPMiddleware):
 
 app.add_middleware(SecurityHeadersMiddleware)
 
+# 后台登录滑动续期：24h 空闲过期，7d 绝对上限。
+app.add_middleware(SessionRenewalMiddleware)
+
 # 注册路由
 app.include_router(auth.router)
 app.include_router(users.router)