fix(session): align auth cookie maxAge with Redis session TTL

[hariom888]

Problem

getAuthCookieOptions() in app/api/auth/session/route.js set maxAge: 60 * 60 (1 hour) for both the authToken and sessionId cookies. createSession() in lib/sessionManager.js persisted the session in Redis with ex: 24 * 60 * 60 (24 hours), and the user:sessions:{userId} set was also expired after 24 hours. The two lifetimes were set independently with no shared constant, so they had drifted (1h vs 24h).

Consequences:

• After 1h, the browser drops both cookies — the client appears logged out and has no sessionId cookie left to call
  DELETE /api/auth/session and cleanly terminate the session.
• The Redis session:{sessionId} entry stays valid for up to 23 more hours, showing up as a "ghost" active session in admin tooling (app/api/admin/sessions/terminate/route.js) that the legitimate user can no longer terminate themselves, and which occupies the single-session slot enforced by createSession's termination logic on the user's next real login.

Fix

Extract a single shared constant, SESSION_TTL_SECONDS, in lib/sessionConstants.js, and use it for both:

• the cookie maxAge in getAuthCookieOptions()
• the Redis TTL (ex/expire) in createSession()

The cookie lifetime was raised to match the 24h Redis TTL (rather than shrinking the Redis TTL to 1h), since the single-session-per-user guarantee is meant to hold for the session's full real lifetime. The logout path's cookie-clearing (maxAge: 0) is unaffected.

Tests

• lib/__tests__/sessionTtlConsistency.test.js: asserts the TTL createSession passes to Redis equals SESSION_TTL_SECONDS — the exact "fails CI if they drift" guard requested in the issue.
• app/api/auth/session/__tests__/route.test.js: asserts both the authToken and sessionId cookies set by POST /api/auth/session have maxAge === SESSION_TTL_SECONDS (and explicitly not the old 60 * 60).

Closes #3805