fix(auth): recover refresh rotations and configure session lifetime

internal/api/AUTH_DESIGN.md

@@ -6,8 +6,17 @@
   session IDs never authenticate. Internal callers and test fixtures must also
   attach a signed access cookie.
 - Refresh is a random 256-bit HttpOnly cookie, scoped to `/api`, with only its
-  SHA-256 hash stored in SQLite. The session has a 24-hour absolute lifetime.
-  Conditional SQL update makes rotation single-use even across concurrent requests.
+  SHA-256 hash stored in SQLite. The session has an absolute lifetime configured
+  by SESSION_TTL (default 24h), applied only to new logins.
+  Session, refresh and CSRF cookies persist across browser restarts with explicit
+  Max-Age/Expires bounded by that database expiry; rotation does not extend it.
+  Transactional rotation stores current and previous token hashes. A keyed,
+  session-bound successor derivation makes retries of the previous token return
+  the same current token, including after response loss or server restart. Only
+  one previous generation is accepted (until the next rotation or session expiry);
+  this intentionally permits that generation to be replayed with the required
+  session/Origin/CSRF checks. Older and unknown tokens are rejected. Plaintext
+  refresh credentials are never stored.
   Logout deletes the database session and its refresh binding. Both refresh and
   logout retain mandatory exact Origin and session-bound CSRF checks, even when
   access has expired. Other operations require valid access.