test(auth): add comprehensive 7-day session tests

- Add seven_day_session_test.go with comprehensive test coverage:
  - Test login returns 7-day session (expires_in: 604800)
  - Test cookie MaxAge is 7 days (604800 seconds)
  - Test refresh token returns 7-day access token
  - Test JWT token has 7-day expiration claim
  - Test 401 error handler redirects HTML requests
  - Test 401 error handler returns JSON for API requests
  - Test register/login do not set document.cookie
- Tests use getTestUserID() and setupTestServer() helpers
- Update security_test.go JWT expiration comment to reflect 7 days

Tests verify all aspects of the 7-day session implementation
including constants usage, cookie values, API responses, and
smart 401 error handling.

cmd/server/tests/security_test.go

@@ -127,9 +127,9 @@ func TestRateLimiterSecurity(t *testing.T) {
 
 // TestJWTExpiration tests that JWT tokens have the correct expiration time
 func TestJWTExpiration(t *testing.T) {
-	// Verify the 1-hour expiration is set correctly
-	// (auth.go line 863: "exp": time.Now().Add(1 * time.Hour).Unix())
-	assert.True(t, true, "JWT expiration set to 1 hour")
+	// Verify the 7-day session expiration is set correctly
+	// (auth.go line 791: "exp": time.Now().Add(SessionDuration).Unix())
+	assert.True(t, true, "JWT expiration set to 7 days")
 }
 
 // TestRefreshTokenExpiration tests refresh token expiration