feat(admin): renew sessions and support remembered login

docs/en/configuration/model.md

@@ -102,6 +102,12 @@ SQLite is the default and recommended database for SynapS3 single-node deploymen
 | `admin.auth.username` | `admin` |
 | `admin.auth.session_ttl` | `12h` |
 
+## Admin Session Lifetime
+
+`admin.auth.session_ttl` controls the lifetime of each standard Admin UI session token. It is neither a server-enforced idle timeout nor an absolute cap on a login. After the earlier of five minutes or half the token lifetime, the server permits renewal. The official dashboard requests renewal only after a trusted pointer, click, keyboard, or wheel interaction; background polling and returning to a visible tab do not trigger it. Any client holding the valid session cookie and matching CSRF token can call the refresh endpoint after `refresh_after`. If no client requests renewal, the token expires at `expires_at`.
+
+The login page uses a browser-session cookie by default. Selecting **Keep me signed in** creates a persistent cookie and uses the greater of 30 days or `admin.auth.session_ttl`. While the dashboard continues to receive user activity, it can keep requesting renewal; the server applies no absolute login lifetime cap.
+
 ## Allowed Values
 
 - `filecoin.network`: `calibration`, `mainnet`.

docs/en/reference/admin-api.md

@@ -17,7 +17,7 @@ http://127.0.0.1:9090
 
 When `/healthz` returns `{"status":"setup"}`, the Admin endpoint exposes only the surfaces needed to finish configuration:
 
-- `/healthz`, Admin login, session, and logout;
+- `/healthz`, Admin login, session, refresh, and logout;
 - the dashboard shell;
 - `GET /api/v1/settings`, `PUT /api/v1/settings`, and `POST /api/v1/settings/validate`;
 - `POST /api/v1/filecoin/readiness/preflight`.
@@ -32,14 +32,20 @@ Runtime metrics, buckets, objects, tasks, wallet operations, storage health, and
 | --- | --- |
 | `/healthz` | None. |
 | `/api/v1/auth/login`, `/api/v1/auth/session` | Login and session endpoints. Session returns `401` when no valid browser session exists. |
-| `/api/v1/auth/logout` | Requires a valid browser session and CSRF header; HTTP Basic auth is not accepted. |
+| `/api/v1/auth/refresh`, `/api/v1/auth/logout` | Require a valid browser session and CSRF header; HTTP Basic auth is not accepted. |
 | `/api/v1/*` | Browser session cookie with CSRF for unsafe methods, or HTTP Basic auth. |
 | `/metrics` | Browser session cookie or HTTP Basic auth. |
 | `/admin/exhausted-tasks*` | Browser session cookie with CSRF for unsafe methods, or HTTP Basic auth. |
 
 ### Browser Sessions
 
-Browser login sets the `synaps3_admin_session` HttpOnly cookie and returns a CSRF token. Cookie-authenticated `POST`, `PUT`, `PATCH`, and `DELETE` requests must include `X-SynapS3-CSRF`. Logout only accepts browser sessions.
+Browser login sets the `synaps3_admin_session` HttpOnly cookie and returns a CSRF token. Cookie-authenticated `POST`, `PUT`, `PATCH`, and `DELETE` requests must include `X-SynapS3-CSRF`. Refresh and logout only accept browser sessions.
+
+The optional `remember` boolean in the login request defaults to `false`. A standard login uses a browser-session cookie and the configured `admin.auth.session_ttl`. When `remember` is `true`, the cookie persists for the greater of 30 days or the configured session TTL. Some browsers can restore browser-session cookies when restoring a previous browsing session.
+
+Login, session, and refresh responses contain `username`, `csrf_token`, `expires_at`, and `refresh_after`. After `refresh_after`, the official dashboard requests renewal on the next trusted pointer, click, keyboard, or wheel interaction. Dashboard polling and returning to a visible tab do not trigger renewal. The server does not verify user activity: any client holding the valid session cookie and matching CSRF token can request renewal after `refresh_after`. The login has no absolute lifetime cap. If no client requests renewal, the token expires at `expires_at`.
+
+Refresh preserves the session lifetime, CSRF token, and login family. Logout revokes the whole family, including tokens issued before the latest refresh. Revocations are kept in memory; restarting SynapS3 clears them, although the browser cookie is still removed during a normal logout.
 
 ### CLI and Basic Auth
 
@@ -65,8 +71,9 @@ synaps3 admin-auth reset-password --config /var/lib/synaps3/config.toml
 
 | Method | Path | Purpose |
 | --- | --- | --- |
-| `POST` | `/api/v1/auth/login` | Validate username and password, set the browser cookie, and return a CSRF token. |
-| `GET` | `/api/v1/auth/session` | Return the current browser session and CSRF token. |
+| `POST` | `/api/v1/auth/login` | Validate username and password, accept optional `remember`, set the browser cookie, and return the session. |
+| `GET` | `/api/v1/auth/session` | Return the current browser session. |
+| `POST` | `/api/v1/auth/refresh` | Require session and CSRF, then renew an eligible browser session. Early requests return the current session without changing the cookie. |
 | `POST` | `/api/v1/auth/logout` | Require session and CSRF, end the current browser session, and clear the cookie. |
 
 After logout or a `401` API response, the dashboard returns to the login page.

docs/zh/configuration/model.md

@@ -102,6 +102,12 @@ SQLite 是 SynapS3 单机部署的默认且推荐数据库。已有 PostgreSQL 
 | `admin.auth.username` | `admin` |
 | `admin.auth.session_ttl` | `12h` |
 
+## Admin 会话时长
+
+`admin.auth.session_ttl` 控制每个普通 Admin UI 会话 token 的有效时长，既不是服务端强制的空闲超时，也不是一次登录的绝对上限。经过 5 分钟或 token 有效时长的一半（取较短者）后，服务端允许续期。官方仪表盘只在可信的指针、点击、键盘或滚轮操作后请求续期；后台轮询和仅切回可见标签页不会触发续期。任何持有有效 session cookie 和对应 CSRF token 的客户端，都可以在 `refresh_after` 之后调用续期接口。没有客户端请求续期时，token 会在 `expires_at` 到期。
+
+登录页默认使用 browser-session cookie。选择 **Keep me signed in** 后，会改用持久 cookie，并使用 30 天或 `admin.auth.session_ttl` 中较长的时长。只要仪表盘持续收到用户操作，就可以继续请求续期；服务端不设置登录的绝对时长上限。
+
 ## 允许值
 
 - `filecoin.network`: `calibration`, `mainnet`。

docs/zh/reference/admin-api.md

@@ -17,7 +17,7 @@ http://127.0.0.1:9090
 
 当 `/healthz` 返回 `{"status":"setup"}` 时，Admin 端点只开放完成配置所需的范围：
 
-- `/healthz`，以及 Admin 登录、会话和退出端点；
+- `/healthz`，以及 Admin 登录、会话、续期和退出端点；
 - 仪表盘外壳；
 - `GET /api/v1/settings`、`PUT /api/v1/settings` 和 `POST /api/v1/settings/validate`；
 - `POST /api/v1/filecoin/readiness/preflight`。
@@ -32,14 +32,20 @@ Setup 模式不提供运行时指标、存储桶、对象、后台任务、钱
 | --- | --- |
 | `/healthz` | 无。 |
 | `/api/v1/auth/login`、`/api/v1/auth/session` | 登录和会话端点。没有有效浏览器会话时，`/session` 返回 `401`。 |
-| `/api/v1/auth/logout` | 需要有效浏览器会话和 CSRF header；不接受 HTTP Basic auth。 |
+| `/api/v1/auth/refresh`、`/api/v1/auth/logout` | 需要有效浏览器会话和 CSRF header；不接受 HTTP Basic auth。 |
 | `/api/v1/*` | 浏览器 session cookie；写请求方法需要 CSRF。也可用 HTTP Basic auth。 |
 | `/metrics` | 浏览器 session cookie 或 HTTP Basic auth。 |
 | `/admin/exhausted-tasks*` | 浏览器 session cookie；写请求方法需要 CSRF。也可用 HTTP Basic auth。 |
 
 ### 浏览器会话
 
-浏览器登录会设置 `synaps3_admin_session` HttpOnly cookie，并返回 CSRF token。使用 cookie 认证的 `POST`、`PUT`、`PATCH`、`DELETE` 必须带 `X-SynapS3-CSRF`。Logout 只接受浏览器会话。
+浏览器登录会设置 `synaps3_admin_session` HttpOnly cookie，并返回 CSRF token。使用 cookie 认证的 `POST`、`PUT`、`PATCH`、`DELETE` 必须带 `X-SynapS3-CSRF`。续期和退出只接受浏览器会话。
+
+登录请求中的可选布尔字段 `remember` 默认为 `false`。普通登录使用 browser-session cookie 和配置的 `admin.auth.session_ttl`。`remember = true` 时，cookie 会持久化 30 天或配置的 session TTL，以较长者为准。部分浏览器在恢复上次浏览会话时也会恢复 browser-session cookie。
+
+登录、会话和续期响应包含 `username`、`csrf_token`、`expires_at` 和 `refresh_after`。到达 `refresh_after` 后，官方仪表盘会在下一次可信的指针、点击、键盘或滚轮操作时请求续期。仪表盘轮询和仅切回可见标签页不会触发续期。服务端不验证用户活动：任何持有有效 session cookie 和对应 CSRF token 的客户端，都可以在 `refresh_after` 之后请求续期。登录没有绝对时长上限。没有客户端请求续期时，token 会在 `expires_at` 到期。
+
+续期会保留会话时长、CSRF token 和登录 family。退出会撤销整个 family，包括最近一次续期之前签发的 token。撤销记录保存在内存中；重启 SynapS3 会清空这些记录，但正常退出时浏览器 cookie 仍会被删除。
 
 ### CLI 和 Basic auth
 
@@ -65,8 +71,9 @@ synaps3 admin-auth reset-password --config /var/lib/synaps3/config.toml
 
 | Method | Path | 用途 |
 | --- | --- | --- |
-| `POST` | `/api/v1/auth/login` | 校验用户名和密码，设置浏览器 cookie，并返回 CSRF token。 |
-| `GET` | `/api/v1/auth/session` | 返回当前浏览器会话和 CSRF token。 |
+| `POST` | `/api/v1/auth/login` | 校验用户名和密码，接受可选的 `remember`，设置浏览器 cookie，并返回会话。 |
+| `GET` | `/api/v1/auth/session` | 返回当前浏览器会话。 |
+| `POST` | `/api/v1/auth/refresh` | 需要会话和 CSRF；会话允许续期时重新签发，过早请求只返回当前会话且不修改 cookie。 |
 | `POST` | `/api/v1/auth/logout` | 需要会话和 CSRF，结束当前浏览器会话并清除 cookie。 |
 
 退出登录或收到 `401` API 响应后，仪表盘会返回登录页。