Round session cookie Max-Age without overflowing

Adding time.Second-1 to MEALQUEST_SESSION_MAX overflowed time.Duration
near its largest accepted value, giving a negative MaxAge that net/http
sends as Max-Age=0. Divide by time.Second and increment the quotient
when there is a remainder instead.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/auth/session_test.go

@@ -333,6 +333,22 @@ func TestSessionCookieOutlivesFractionalMax(t *testing.T) {
 	}
 }
 
+// A lifetime near the largest accepted duration still yields a positive,
+// rounded-up cookie Max-Age rather than overflowing.
+func TestSessionCookieMaxAgeNearLargestMax(t *testing.T) {
+	t.Parallel()
+	largest, err := time.ParseDuration("2562047h47m16.854s")
+	if err != nil {
+		t.Fatal(err)
+	}
+	h := newSessionHarness(t)
+	h.sessions.max = largest
+	_, cookie := h.signIn(t)
+	if want := 9223372037; cookie.MaxAge != want {
+		t.Errorf("session cookie MaxAge = %d, want %d", cookie.MaxAge, want)
+	}
+}
+
 // A lifetime shortened by configuration applies to existing sessions even
 // though their stored expires_at is later.
 func TestSessionLifetimeChecksUseCurrentConfig(t *testing.T) {