fix: increase JWT session to 30 days + auto-refresh in middleware

JWT session tokens now last 30 days instead of 24 hours. The middleware
silently refreshes the token when it has less than 7 days remaining,
so active users never get locked out of the dashboard.

Auto-refresh fires on any /dashboard request and sets a fresh 30-day
cookie via Set-Cookie header — completely transparent to the user.

src/app/api/auth/login/route.ts

@@ -57,7 +57,7 @@ export async function POST(request) {
 
       const token = await new SignJWT({ authenticated: true })
         .setProtectedHeader({ alg: "HS256" })
-        .setExpirationTime("24h")
+        .setExpirationTime("30d")
         .sign(SECRET);
 
       const cookieStore = await cookies();