fix(hub,web): extend JWT expiration and harden visibility refresh (#442)

- Extend JWT expiration from 15 minutes to 4 hours in both auth and
  bind endpoints. 15 minutes was too short — browser timer throttling
  in background tabs prevented the scheduled refresh from firing
  before expiration, causing unexpected logouts.

- Change the visibility/focus refresh from conditional (minTtlMs) to
  forced, so returning to a backgrounded tab always re-authenticates
  regardless of remaining token TTL. This eliminates the race between
  timer throttling and token expiration.

HAPI is a self-hosted tool, so the longer token lifetime is an
acceptable security tradeoff. The auth source (Telegram initData or
CLI access token) is still validated on every refresh.

Closes #412

hub/src/web/routes/auth.ts

@@ -71,7 +71,7 @@ export function createAuthRoutes(jwtSecret: Uint8Array, store: Store): Hono<WebA
         const token = await new SignJWT({ uid: userId, ns: namespace })
             .setProtectedHeader({ alg: 'HS256' })
             .setIssuedAt()
-            .setExpirationTime('15m')
+            .setExpirationTime('4h')
             .sign(jwtSecret)
 
         return c.json({

hub/src/web/routes/bind.ts

@@ -51,7 +51,7 @@ export function createBindRoutes(jwtSecret: Uint8Array, store: Store): Hono<WebA
         const token = await new SignJWT({ uid: userId, ns: namespace })
             .setProtectedHeader({ alg: 'HS256' })
             .setIssuedAt()
-            .setExpirationTime('15m')
+            .setExpirationTime('4h')
             .sign(jwtSecret)
 
         return c.json({

web/src/hooks/useAuth.ts

@@ -267,7 +267,7 @@ export function useAuth(authSource: AuthSource | null, baseUrl: string): {
         }
 
         const handleActive = () => {
-            void refreshAuth({ minTtlMs: 60_000 })
+            void refreshAuth({ force: true })
         }
 
         const handleVisibilityChange = () => {