auth: JWT valid until logout (drop 8h expiry)

Booth reality breaks a fixed clock (relief late/absent, forced double shifts),
and a shift is a separate explicit boundary. Drop expiresIn from the global jwt
config and from login; the token carries no exp. Cookie maxAge = 30 days so a
browser restart doesn't log out an active operator; logout still clears it.

wiki/entities/local-jwt-auth.md

@@ -14,13 +14,13 @@ Authentication and authorization, kept **fully local** — a direct consequence
 - `@fastify/jwt` signs tokens with a **local secret** (symmetric HMAC). The server **refuses to
   start** without a strong `JWT_SECRET` (≥32 chars, no placeholder) — there is deliberately no
   insecure default.
-- **Session lifetime: valid until explicit logout — no time expiry** (decision 2026-06-15).
+- **Session lifetime: valid until explicit logout — no time expiry** (decision 2026-06-15, built).
   Booth reality breaks any fixed clock: relief arrives late, fails to show, or one operator is
   forced to work two shifts in a row — a token that expired mid-duty would strand an active
   operator. So the login persists until logout; a **[[shift]] is a separate, explicit boundary**,
   not tied to token lifetime. (Superseded the earlier "8h expiry, bound to a shift" assumption.)
-  > ⚠️ Code still mints an 8h-expiry token — this page records the decided design; the server
-  > change (drop `expiresIn`, persist until logout) is pending.
+  The JWT carries no `exp`; the cookie has a long fixed `maxAge` (30 days) so a browser restart
+  doesn't log out an active operator, and `logout` clears it.
 - A `users` table in [[sqlite]] holds **bcrypt** password hashes plus a **role** column. The
   first admin is seeded via `pnpm --filter @parking/server seed-admin` (no bootstrap endpoint).
 - Authorization = a simple `preHandler` role guard per route: **admin / operator / cashier /