fix: Session cookie lifetime, renewal, CSRF echo, and current-session…

[m-t-a97]

… GET /me and sign-out

Sessions and cookies drifted apart in several places, and both GET /me and POST /sign-out assumed the user's newest session was the current one. A user signed in on two devices could see, or revoke, the wrong session.

Session plugin

• renew sessions in place instead of delete+create
• cap cookie Max-Age to the session lifetime; ClearSessionCookie carries SameSite
• warn at startup when UpdateAge >= ExpiresIn
• expose the authenticated session id on the request context

CSRF plugin

• echo X-AUTHULA-CSRF-TOKEN on every safe request
• compare tokens in constant time

Config

• CookieMaxAge defaults to and follows ExpiresIn

Core

• GET /me returns the session that authenticated the request (GetMe now takes sessionID)
• POST /sign-out with no body revokes the caller's own session; a supplied session_id must belong to the caller (403) and must exist (404); sign_out_all is unchanged; the newest-session fallback remains only for non-cookie actors
• auth.sign_out (cookie clear) is set only when the caller's own session was revoked, so revoking another session by id keeps the caller signed in
• CoreAPI.SignOut signature: (ctx, userID, currentSessionID, requestedSessionID, signOutAll)

Admin

• restored impersonation cookie carries Max-Age

Tests and docs

• new handler tests for sign-out, rewritten usecase table, extended session/CSRF/config tests
• docs/core/sign-out.md and updated OpenAPI description