auth, docs: a session from a longer window is cut; the remaining nits (audit A6, A7, A10, W7)

Security audit 2026-10-17, stage 6.

A10: a session created under a longer PANEL_SESSION_IDLE_DAYS kept its old
expiry after the setting was lowered (the renewal arithmetic took
ExpiresAt minus the new window for the last renewal). Touch now cuts such
a session to now plus the window at once. TestSessionMadeUnderALongerWindowIsCut.

A6, A7, W7 - security.md now says what the code does, which is what it
should do: a wrong method answers 405 with Allow from the router before the
role is looked at (the routes are public source); the setup token is made
anew at the first /setup/ request after expiry, a stranger's included, and
logged where only the operator reads it; two GETs make what must exist,
the server's own DKIM key on Settings and Health. README's local trial
says the compose file is the hardened deployment.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/auth/auth_test.go

@@ -379,3 +379,22 @@ func TestRequireAuthDoesNotRenewASessionWhoseUserIsGone(t *testing.T) {
 		t.Errorf("expiry of a missing user's session moved to %v", row.ExpiresAt)
 	}
 }
+
+// A session made under a longer idle window is cut to the current one at its
+// next renewal check, not kept until its old expiry (security audit
+// 2026-10-17, A10).
+func TestSessionMadeUnderALongerWindowIsCut(t *testing.T) {
+	s := newTestSessionStore(t) // seven days
+	token := mustCreate(t, s, "admin")
+	s.idle = 24 * time.Hour // PANEL_SESSION_IDLE_DAYS lowered to one
+	if !s.Touch(token) {
+		t.Fatal("the session from the longer window was not cut")
+	}
+	row, _, err := s.store.LookupSession(hashToken(token))
+	if err != nil || row.ExpiresAt.After(time.Now().Add(24*time.Hour+time.Minute)) {
+		t.Errorf("expires %v (%v), want within a day", row.ExpiresAt, err)
+	}
+	if s.Touch(token) {
+		t.Error("a session within the window was renewed again at once")
+	}
+}