Round session cookie Max-Age up to whole seconds

A maximum session lifetime with fractional seconds (e.g. 2500ms) was
truncated to a 2-second cookie Max-Age, so the browser dropped the
cookie before the server-side absolute limit. Round up instead; the
stored expires_at keeps the configured duration.

Fixes review finding MQ-19-2.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/auth/session.go

@@ -91,8 +91,9 @@ func (m *SessionManager) StartSession(w http.ResponseWriter, r *http.Request, cl
 	}
 
 	// The cookie outlives idle gaps so a returning device presents its ID;
-	// the server decides whether the session is still live.
-	http.SetCookie(w, sessionCookie(id, int(m.max/time.Second)))
+	// the server decides whether the session is still live. Max-Age is whole
+	// seconds, rounded up so the cookie never ends before the absolute limit.
+	http.SetCookie(w, sessionCookie(id, int((m.max+time.Second-1)/time.Second)))
 	return nil
 }