Add activity logs, sidebar badges, and logout with working alert colors.

Record auth audits and surface them in Activity, poll sidebar counts without resetting idle, and add a profile logout path plus theme red/green/blue tokens so failure badges render.

service/internal/api/middleware.go

@@ -10,6 +10,8 @@ import (
 	"codeberg.org/SquidSE/ClusterCanvas/service/internal/settings"
 )
 
+const sessionIdleExemptHeader = "X-Session-Idle-Exempt"
+
 func (app *App) withMiddleware(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {
 		path := request.URL.Path
@@ -75,7 +77,8 @@ func (app *App) withMiddleware(next http.Handler) http.Handler {
 		}
 
 		security := effectiveSecurity(settingsPayload.Security)
-		session, err := app.Sessions.LookupValidSession(writer, request, security)
+		touchActivity := request.Header.Get(sessionIdleExemptHeader) != "1"
+		session, err := app.Sessions.LookupValidSession(writer, request, security, touchActivity)
 		if err != nil {
 			errorMessage := "authentication required"
 			if errors.Is(err, auth.ErrSessionIdle) {
@@ -142,7 +145,7 @@ func (app *App) withCORS(next http.Handler) http.Handler {
 			writer.Header().Set("Vary", "Origin")
 		}
 		writer.Header().Set("Access-Control-Allow-Methods", "GET, POST, PUT, PATCH, DELETE, OPTIONS")
-		writer.Header().Set("Access-Control-Allow-Headers", "Content-Type")
+		writer.Header().Set("Access-Control-Allow-Headers", "Content-Type, "+sessionIdleExemptHeader)
 
 		if request.Method == http.MethodOptions {
 			writer.WriteHeader(http.StatusNoContent)