auth, docs: a session from a longer window is cut; the remaining nits (audit A6, A7, A10, W7)

Security audit 2026-10-17, stage 6.

A10: a session created under a longer PANEL_SESSION_IDLE_DAYS kept its old
expiry after the setting was lowered (the renewal arithmetic took
ExpiresAt minus the new window for the last renewal). Touch now cuts such
a session to now plus the window at once. TestSessionMadeUnderALongerWindowIsCut.

A6, A7, W7 - security.md now says what the code does, which is what it
should do: a wrong method answers 405 with Allow from the router before the
role is looked at (the routes are public source); the setup token is made
anew at the first /setup/ request after expiry, a stranger's included, and
logged where only the operator reads it; two GETs make what must exist,
the server's own DKIM key on Settings and Health. README's local trial
says the compose file is the hardened deployment.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -49,6 +49,9 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
 - **The signature covers `Content-Type`, `MIME-Version` and `Message-ID`**
   when the message has them (audit M6), and a header line too long to be
   delivered unbroken is named in the log as a body line is (M8).
+- **A session made under a longer `PANEL_SESSION_IDLE_DAYS` is cut to the
+  current window** at its next request (audit A10), not kept until its old
+  expiry.
 - **The TLS private key no longer has to be readable by Postfix** (audit
   I1): the guide gave it to group 10998 for the panel's backup, and
   `postfix` is in that group, so every Postfix daemon - an smtpd talking to
@@ -103,6 +106,12 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
 
 ### Documentation
 
+- security.md says what the code does where it said more (audit A6, A7,
+  W7): a wrong method answers `405` before the role is looked at; the setup
+  token is made anew at the first request after it expired; two GETs make
+  the server's own DKIM key on first view. The README's local trial says
+  that the compose file is the hardened deployment.
+
 - **The upstream's "Required" TLS checks no certificate**, and the guide and
   Help now say so (audit M7): it guards against a listener, not against one
   who answers in the upstream's place.