Preserve and renew browser sessions across short access-token expiry

ReviewOS browser sessions repeatedly become signed out while following long CI runs. Current configuration deliberately expires access tokens after one hour and describes a 30-day rotating refresh credential, but the browser form flow does not retain that credential.

Source evidence at main 4ea9889:

• config/auth.ts sets tokenExpiry to one hour and refreshTokenExpiry to 30 days.
• app/Actions/Auth/LoginAction.ts signedIn() sets only the access-token cookie. Its HTML response is a 303 redirect, while refresh_token is returned only in the JSON response.
• No refresh transport/route is registered in ReviewOS. Server-rendered identity reads only the access cookie. Register, SSO and social browser issuance also need to participate in a common browser-session contract.

This explains a missing renewal path; it is not evidence that deployment rotates APP_KEY or corrupts cookies. Both available Dia profiles were independently observed signed out on private workflow pages. Authentication failures correctly do not disclose private runs.

Implement this through the first-party framework's authentication primitives. Do not silently increase access-token lifetime, disable idle/revocation checks, introduce an operator impersonation path, store refresh credentials in browser-readable storage, or create an unrelated service token to bypass browser sign-in.

Required behavior and verification:

• Preserve an explicitly configured browser-session policy and a properly protected renewal credential across the form redirect, with consistent issuance from password/MFA, registration, SSO and social sign-in.
• A browser can resume an authorized private workflow after the short access token expires, using the normal session path.
• Origin/CSRF checks apply to cookie-authenticated renewal; account revocation, password changes, logout and expiry invalidate the proper credential family.
• Concurrent tabs/requests cannot double-spend rotation, replace a fresh browser cookie with a stale result, or weaken replay detection. Use real HTTP and database tests for these races.
• API/bearer clients retain their existing JSON contract and short access-token lifetime. No secret values in logs, tests or issue text.

Operational impact: the missing browser renewal repeatedly interrupts HQ enterprise acceptance and manual dispatch of repository-scoped native workflows. Related launch tracker: https://github.com/stacksjs/hq.training/issues/346 and native checkout proof: https://github.com/stacksjs/hq.training/issues/376.