[Fix] Unexpected web logouts when users return to the site

[roomote-roomote]

​Opened on behalf of @mrubens. Follow up by mentioning @roomote-roomote, in the web UI, or in Slack.

What changed

• Set an explicit 30-day web session lifetime with rolling renewal eligible every 24 hours.
• Keep server-rendered authentication reads non-refreshing. Only the browser-facing tRPC HTTP route opts into renewal, where Next.js can send the renewed cookie along with the database expiry update; server callers remain read-only.
• Retain server regression tests and concise session-policy documentation. This PR contains no sign-in, recovery, provider-navigation, reset-confirmation, or return-destination UI changes.

The previous seven days was Better Auth's inherited default. A full HTML render could extend the database session while its cookie write failed; subsequent requests then considered renewal unnecessary for another day. The integration regression reproduces that failure and verifies the corrected render-to-route flow.

Still-valid older sessions adopt 30 days on their next renewing browser request. Expired cookies or sessions are not resurrected; no database migration is required. Logout, administrative revocation, password-reset revocation, signing-key invalidation, and existing access policies remain intact. Secure, HttpOnly, SameSite=Lax, host-only cookies and authoritative database checks are unchanged. Longer idle persistence increases the lifetime of a stolen cookie; sleeping or closed browsers do not renew sessions.

How it was tested

• Re-ran all 32 focused server tests across five files, including real Better Auth, Next.js request/cookie phases, and Postgres coverage for HTML/RSC reads, legacy-session upgrade, paired DB/cookie renewal, 24-hour throttling, expiry, logout, and administrative deletion.
• Web TypeScript checks and documentation validation/broken-link checks passed.
• Full pre-push oxlint, residual lint, fast type checks, and knip passed without bypassing hooks.
• Verified the six UI/helper/client-test files exactly match the PR base and all retained backend files are unchanged by the scope reduction. Browser screenshots are not applicable to the backend/session-only net diff; earlier UI proof has been removed.

Checklist

• The PR title follows the repo convention: [Fix], [Feat], [Improve], [Refactor], [Docs], or [Chore] followed by a user-facing description
• This PR is small and scoped to one change
• pnpm lint and pnpm check-types pass locally (package TypeScript and full pre-push equivalents passed; root commands not separately run)
• I added tests or included a clear manual validation note above
• I removed secrets, tokens, private keys, and customer data from code, logs, and screenshots
• If this change should appear in the changelog, I ran pnpm changeset

[roomote-community]

No new code issues found. See task

_{Reviewed 4c004b6}

[roomote-roomote]

Removed the UI/recovery additions in 4c004b6 and updated the PR description, including removal of obsolete UI screenshots.

The remaining scope is the 30-day session policy, reliable browser-cookie/server rolling renewal, 32 server regression tests, and session-policy documentation. All six UI/helper/client-test files now exactly match the PR base; the retained backend files are unchanged by this revision.

Verification: 32 focused server tests, web TypeScript, docs validation/link checks, and all pre-push gates passed. No sign-in/admission policy or UI changes remain in the net diff.