Show a login notice when a session ends due to idle timeout.

Return a distinct session_idle error from the API and reload to /login with a clear signed-out message.

service/internal/auth/session.go

@@ -20,7 +20,10 @@ const (
 	sessionRotateAfter = time.Hour
 )
 
-var ErrSessionNotFound = errors.New("session not found")
+var (
+	ErrSessionNotFound = errors.New("session not found")
+	ErrSessionIdle     = errors.New("session idle")
+)
 
 // SessionManager persists sessions in sessions.enc and sets hardened cookies.
 type SessionManager struct {
@@ -108,6 +111,7 @@ func (manager *SessionManager) LookupValidSession(
 	lifetime := time.Duration(security.SessionLifetimeHours) * time.Hour
 
 	var found *settings.SessionRecord
+	idleMatched := false
 	remaining := make([]settings.SessionRecord, 0, len(store.Sessions))
 	for index := range store.Sessions {
 		session := store.Sessions[index]
@@ -116,6 +120,7 @@ func (manager *SessionManager) LookupValidSession(
 		}
 		if session.ID == cookie.Value {
 			if now.Sub(session.LastSeenAt) > idleLimit {
+				idleMatched = true
 				continue
 			}
 			copySession := session
@@ -129,6 +134,9 @@ func (manager *SessionManager) LookupValidSession(
 		store.Sessions = remaining
 		_ = settings.SaveSessions(manager.configDir, store, manager.key)
 		clearSessionCookie(writer)
+		if idleMatched {
+			return settings.SessionRecord{}, ErrSessionIdle
+		}
 		return settings.SessionRecord{}, ErrSessionNotFound
 	}