fix(security): include timeToLive in login responses

[dirkwa]

Fixes #1476

Summary

The Signal K specification requires login responses to include a timeToLive field indicating how long the token is valid, in seconds. The server was only returning the token field.

Adds timeToLive to both REST (/signalk/v1/auth/login) and WebSocket login responses. When the server's token expiration is set to NEVER, the field is omitted.

Test

Tested manually against a server with security enabled (port 4000):

REST login:

curl -s -X POST http://localhost:4000/signalk/v1/auth/login \
  -H 'Content-Type: application/json' \
  -d '{"username":"admin","password":"***"}' | jq

Response includes timeToLive (in seconds) alongside token.

WebSocket login:

wscat -c ws://localhost:4000/signalk/v1/stream
> {"requestId":"1","login":{"username":"admin","password":"***"}}

Response includes timeToLive in the login reply.

NEVER expiration: With server configured for NEVER token expiration, verified timeToLive is correctly omitted from the response.

Duration calculations verified: 1h→3600, 24h→86400, 7d→604800.