feat: Session token short lived web admin (M2-11000)

[sricharan-varanasi]

• Tests for the changes have been added
• Related documentation has been added / updated
• For new features, QA automation engineers have been tagged
• OSS packages added to
  Curious open source credit page

📝 Description

🔗 Jira Ticket M2-11000

Stacked on #2097 (BE-1, client identification). Base branch is session-token-client-type;

Gives web and admin clients shorter session-token lifetimes, while mobile keep today's lifetimes unchanged. Reuses the client JWT claim added in #2097 to decide which lifetime applies.

Client	Access	Refresh
web / admin	15 min	30 min
mobile / unknown / legacy	30 min (unchanged) from .env.default	540 min (unchanged) from .env.default

Changes include:

• New web_admin_expiration setting on both AccessTokenSettings and RefreshTokenSettings, plus a token_expiration_minutes resolver that routes web/admin to the short value and everyone else to the existing value.
• Per-client lifetime applied at token issuance (login and both MFA-verify flows); the refresh endpoint needed no change since it already carries the client claim forward.
• Fixed the refresh-token revocation derivation (_get_refresh_token_by_access) to use the per-client lifetime, so a revoked short-lived token cannot be un-revoked early by blacklist cleanup.

🪤 Peer Testing

Run locally with AUTHENTICATION__ACCESS_TOKEN__WEB_ADMIN_EXPIRATION=1 and AUTHENTICATION__REFRESH_TOKEN__WEB_ADMIN_EXPIRATION=3 (minutes) to make the windows easy to observe.

• POST /auth/login with header Mindlogger-Content-Source: admin (or web); decode both returned tokens.

  Expected outcome: access exp ≈ now + 1 min, refresh exp ≈ now + 3 min.

• POST /auth/login with Mindlogger-Content-Source: mobile, or with no header.

  Expected outcome: access ≈ now + 30 min, refresh ≈ now + 540 min (unchanged).

• POST /auth/token/refresh with the admin refresh token.

  Expected outcome: a new short-lived access token; once the refresh window elapses, refresh returns 400 (expired) and the user must log in again.

• POST /auth/login (admin) → POST /auth/logout → POST /auth/token/refresh with that refresh token.

  Expected outcome: 401 - logout revoked the paired refresh token.

✏️ Notes

• On by default: the 15/30 values are baked into config/authentication.py, so this takes effect in every environment on deploy. They can be overridden per environment via the AUTHENTICATION__*_TOKEN__WEB_ADMIN_EXPIRATION env vars.
• Refresh tokens do not rotate/slide yet, so an active web/admin user is currently capped at 30 minutes before a forced re-login. Extending sessions while active (a sliding 30-min idle window) is a planned follow-up ticket.

[adeiji]

This looks good @sricharan-varanasi !