fix(auth): a cookie that lands after sign-out no longer signs the browser back in

A renewal answers with the session its request started with. Each session now
carries an id; signing out, or signing in as someone else, revokes it
(revoked_sessions, migration 0120), and a cookie carrying a revoked id is
refused. A cookie from before session ids gets one drawn from the cookie
itself. The race after log-out-everywhere fails closed and stays.

backend/app/main.py

@@ -26,6 +26,7 @@ configure_logging("api")
 
 log = logs.get_logger(__name__)
 from app import bodylimit, collation, logsink, state, sysconfig  # noqa: E402 — logging is configured first
+from app import auth as auth_core  # noqa: E402 — logging is configured first
 from app.config import settings  # noqa: E402 — logging is configured first
 from app.db import SessionLocal, engine  # noqa: E402 — logging is configured first
 import app.tables  # noqa: E402 — every table, before the first query
@@ -221,6 +222,7 @@ async def _nul_in_text(request: Request, exc: DataError) -> JSONResponse:
 app.add_middleware(
     SessionMiddleware,
     secret_key=settings.secret_key,
+    max_age=auth_core.SESSION_MAX_AGE,  # the revoked-session rows outlive it (`auth.revoke_session`)
     same_site="lax",  # required so the cookie rides the OAuth redirect back from Google
     https_only=settings.session_https_only,  # Secure flag when served over HTTPS (prod)
 )