feat(auth): 登录态改为滑动续期（后台 24h/7d，打手 7d/30d）

apps/backend/src/config/defaults.ts

@@ -67,7 +67,9 @@ export function createDefaultRuntimeConfig(projectRoot: string): RuntimeConfig {
 
     admin: {
       sessionSecret: '',
-      sessionTtlHours: 12,
+      // 后台：24h 空闲过期，登录后最多 7 天必须重新登录。
+      sessionIdleTtlHours: 24,
+      sessionAbsoluteTtlHours: 168,
       defaultUsers: [],
     },
 
@@ -122,6 +124,9 @@ export function createDefaultRuntimeConfig(projectRoot: string): RuntimeConfig {
         dailyLimit: 10,
       },
       orderTimelineVisible: false,
+      // 打手：7 天空闲过期，登录后最多 30 天必须重新登录。
+      sessionIdleTtlHours: 168,
+      sessionAbsoluteTtlHours: 720,
     },
   }
 }

apps/backend/src/config/env-overrides.test.ts

@@ -128,7 +128,8 @@ function createRuntimeConfig(): RuntimeConfig {
     },
     admin: {
       sessionSecret: '',
-      sessionTtlHours: 12,
+      sessionIdleTtlHours: 24,
+      sessionAbsoluteTtlHours: 168,
       defaultUsers: [],
     },
     platforms: {
@@ -177,6 +178,8 @@ function createRuntimeConfig(): RuntimeConfig {
         dailyLimit: 10,
       },
       orderTimelineVisible: false,
+      sessionIdleTtlHours: 168,
+      sessionAbsoluteTtlHours: 720,
     },
     cors: {
       allowedOrigins: ['*'],

apps/backend/src/config/env-overrides.ts

@@ -56,7 +56,12 @@ export const ENV_OVERRIDES: readonly EnvOverride[] = [
   stringEnv('STORAGE_OSS_REGION', ['storage', 'oss', 'region']),
   integerEnv('CLAIM_TOKEN_TTL_HOURS', ['orders', 'tokenTtlHours']),
   stringEnv('ADMIN_SESSION_SECRET', ['admin', 'sessionSecret']),
-  integerEnv('ADMIN_SESSION_TTL_HOURS', ['admin', 'sessionTtlHours']),
+  // 兼容旧变量：固定 TTL 时代按“绝对上限”理解，空闲窗口仍用新默认值并被绝对上限钳制。
+  integerEnv('ADMIN_SESSION_TTL_HOURS', ['admin', 'sessionAbsoluteTtlHours']),
+  integerEnv('ADMIN_SESSION_IDLE_TTL_HOURS', ['admin', 'sessionIdleTtlHours']),
+  integerEnv('ADMIN_SESSION_ABSOLUTE_TTL_HOURS', ['admin', 'sessionAbsoluteTtlHours']),
+  integerEnv('WORKER_SESSION_IDLE_TTL_HOURS', ['worker', 'sessionIdleTtlHours']),
+  integerEnv('WORKER_SESSION_ABSOLUTE_TTL_HOURS', ['worker', 'sessionAbsoluteTtlHours']),
   adminUsersJsonEnv('ADMIN_DEFAULT_USERS_JSON', ['admin', 'defaultUsers']),
   stringEnv('KAQUAN91_USER_ID', ['platforms', 'ninetyone', 'userId']),
   stringEnv('KAQUAN91_SECRET', ['platforms', 'ninetyone', 'secret']),

apps/backend/src/config/runtime-validation.test.ts

@@ -192,7 +192,8 @@ function createRuntimeConfig(overrides: Record<string, unknown> = {}): RuntimeCo
       },
       admin: {
         sessionSecret: '0123456789abcdef0123456789abcdef',
-        sessionTtlHours: 12,
+        sessionIdleTtlHours: 24,
+        sessionAbsoluteTtlHours: 168,
         defaultUsers: [
           {
             username: 'admin',
@@ -247,6 +248,8 @@ function createRuntimeConfig(overrides: Record<string, unknown> = {}): RuntimeCo
           dailyLimit: 10,
         },
         orderTimelineVisible: false,
+        sessionIdleTtlHours: 168,
+        sessionAbsoluteTtlHours: 720,
       },
     },
     overrides,

apps/backend/src/config/runtime-validation.ts

@@ -97,7 +97,16 @@ export function validateRuntimeConfig(
     })
   }
   requireInteger(issues, 'orders.tokenTtlHours', config.orders?.tokenTtlHours, { min: 0 })
-  requireInteger(issues, 'admin.sessionTtlHours', config.admin?.sessionTtlHours, { min: 1 })
+  requireInteger(issues, 'admin.sessionIdleTtlHours', config.admin?.sessionIdleTtlHours, { min: 1 })
+  requireInteger(issues, 'admin.sessionAbsoluteTtlHours', config.admin?.sessionAbsoluteTtlHours, {
+    min: 1,
+  })
+  requireInteger(issues, 'worker.sessionIdleTtlHours', config.worker?.sessionIdleTtlHours, {
+    min: 1,
+  })
+  requireInteger(issues, 'worker.sessionAbsoluteTtlHours', config.worker?.sessionAbsoluteTtlHours, {
+    min: 1,
+  })
 
   validateOptionalHttpUrl(issues, 'orders.claimBaseUrl', config.orders?.claimBaseUrl)
   validateOptionalStorageEndpoint(issues, 'storage.endpoint', config.storage?.endpoint)