v0.5.0 — Configurable sliding session lifetime + on-by-default entitlement freshness

Separates login lifetime (authentication) from entitlement freshness (authorization), which were previously conflated by a hardcoded 24h session that forced a ~daily re-login.

Sessions

• Configurable, rolling session TTL via session: { ttl }, default 30 days. Sessions renew on activity once less than half the window remains — active users effectively never re-login; idle sessions still expire.
• session_id is now a persistent (Max-Age) cookie and its Max-Age is refreshed on renewal.

Entitlement freshness

• Flattened freshness: { ttl, cron, webhook } → per-provider entitlementTtl / entitlementCron / entitlementWebhook.
• entitlementTtl is now ON by default for entitlement providers — 1 day for Patreon, 15 min otherwise — as a backstop for missed webhooks. entitlementTtl: false disables it.
• Durations are a named-unit object ({ days: 30 }, { minutes: 15 }) or a plain number of ms, via a shared Duration + durationToMs(). Applied to both session.ttl and entitlementTtl.

⚠️ Breaking changes

• freshness.* config removed → entitlementTtl / entitlementCron / entitlementWebhook.
• entitlementTtl default: off → on (1 day Patreon / 15 min other).
• Default session lifetime: fixed 24h → rolling 30 days; session_id → persistent cookie.

See #111 for full detail.