feat: enforce idle + absolute timeouts on admin session

scripts/deploy-server.sh

@@ -97,6 +97,22 @@ chown www-data:xamxam /var/log/xamxam
 chmod 2775 /var/log/xamxam
 ok "Log dir: /var/log/xamxam owned by www-data:xamxam (2775)"
 
+# PHP-FPM session GC must not reap active admin sessions early.
+# The app enforces its own server-side idle/absolute timeouts in AdminAuth
+# (30 min idle / 12 h absolute), so session.gc_maxlifetime needs to be at
+# least the absolute timeout, and GC re-enabled to clean up stale files.
+PHP_FPM_INI="/etc/php/8.4/fpm/conf.d/zz-xamxam-session.ini"
+cat > "$PHP_FPM_INI" <<'INI'
+; XAMXAM session tuning.
+; AdminAuth enforces its own idle/absolute timeouts (30 min / 12 h), so
+; gc_maxlifetime must be >= the absolute timeout or PHP would reap active
+; sessions from under the app.
+session.gc_maxlifetime = 43200
+session.gc_probability = 1
+session.gc_divisor     = 100
+INI
+ok "PHP-FPM session GC: $PHP_FPM_INI"
+
 # Backups dir must be writable by both www-data (cron) and the deploy user
 # (xamxam group) so scripts/migrate.sh can write a pre-deploy snapshot before
 # running migrations.
@@ -164,6 +180,10 @@ echo "------------------------------"
 systemctl reload nginx
 ok "Nginx reloaded"
 
+# Reload PHP-FPM so the session GC settings take effect.
+systemctl reload php8.4-fpm 2>/dev/null || systemctl reload php-fpm 2>/dev/null || true
+ok "PHP-FPM reloaded"
+
 # ── Done ──────────────────────────────────────────────────────────────────────
 printf "\n"
 ok "Permissions fixed"