fix: persist admin sessions in DB so deploys don't log out users

Store PHP sessions in the `sessions` MySQL table (30-day TTL) instead of
server files, which disappear on container restart / redeploy.
Cookie lifetime also extended to 30 days.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

middleware/SessionAuth.php

@@ -1,13 +1,16 @@
 <?php
 declare(strict_types=1);
 
+require_once __DIR__ . '/DbSessionHandler.php';
+
 class SessionAuth
 {
     public static function start(): void
     {
         if (session_status() === PHP_SESSION_NONE) {
+            session_set_save_handler(new DbSessionHandler(), true);
             session_set_cookie_params([
-                'lifetime' => 0,
+                'lifetime' => 86400 * 30, // 30 days — survives deploys
                 'path'     => '/',
                 'secure'   => isset($_SERVER['HTTPS']),
                 'httponly' => true,