auth, docs: a session from a longer window is cut; the remaining nits (audit A6, A7, A10, W7)

Security audit 2026-10-17, stage 6.

A10: a session created under a longer PANEL_SESSION_IDLE_DAYS kept its old
expiry after the setting was lowered (the renewal arithmetic took
ExpiresAt minus the new window for the last renewal). Touch now cuts such
a session to now plus the window at once. TestSessionMadeUnderALongerWindowIsCut.

A6, A7, W7 - security.md now says what the code does, which is what it
should do: a wrong method answers 405 with Allow from the router before the
role is looked at (the routes are public source); the setup token is made
anew at the first /setup/ request after expiry, a stranger's included, and
logged where only the operator reads it; two GETs make what must exist,
the server's own DKIM key on Settings and Health. README's local trial
says the compose file is the hardened deployment.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/security-audit-2026-10-17.md

@@ -850,8 +850,11 @@ the argument.
 - [x] **M7.** guide: upstream `encrypt` checks no certificate. — **Sonnet**,
   0.25 h. *Done 2026-10-17:* guide and Help. (Offering `secure` is hours and a `domain`-user-facing choice;
   propose it on the roadmap, not here.)
-- [ ] **A6, A7, A10, W7, M6, M8** and the README note — half an hour each,
-  or the wording change named under each. — **Sonnet**, 2 h.
+- [x] **A6, A7, A10, W7, M6, M8** and the README note — half an hour each,
+  or the wording change named under each. — **Sonnet**, 2 h. *Done 2026-10-17:* A10 and
+  M6, M8 in code (a session from a longer window is cut at the next check;
+  three headers signed; a long header line logged); A6, A7, W7 by wording
+  in security.md - each is what the code should do; the README note.
 - [ ] **Doc drift sweep** — every line under "Doc and comment drift" above.
   — **Sonnet**, 1 h.
 - **Accept, with the argument:** *the setuid/setgid binaries of the base