fix(auth): persist login and skip redundant login page

src/server.js

@@ -103,7 +103,11 @@ async function route(req, res) {
       clearLoginFailures(req);
       return sendJsonWithHeaders(res, 200, loginHeaders(config), { ok: true });
     }
-    if (url.pathname === '/login' || url.pathname === '/login.html' || url.pathname === '/styles.css' || url.pathname === '/login.js') return serveStatic(req, res);
+    if (url.pathname === '/login' || url.pathname === '/login.html') {
+      if (isAuthenticated(req, config)) return redirect(res, '/');
+      return serveStatic(req, res);
+    }
+    if (url.pathname === '/styles.css' || url.pathname === '/login.js') return serveStatic(req, res);
     if (!isAuthenticated(req, config)) {
       if (url.pathname.startsWith('/api/')) return sendJson(res, 401, { ok: false, error: 'Authentication required.' });
       return redirect(res, '/login');

src/services/auth.js

@@ -3,6 +3,7 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync } from 'n
 import { dirname } from 'node:path';
 
 const COOKIE_NAME = 'kanban_session';
+const SESSION_MAX_AGE_SECONDS = 365 * 24 * 60 * 60;
 const attempts = new Map();
 const LOGIN_WINDOW_MS = 5 * 60 * 1000;
 const MAX_LOGIN_FAILURES = 8;
@@ -101,7 +102,7 @@ export function isAuthenticated(req, config) {
 export function loginHeaders(config) {
   const secure = config.authSecureCookie ? ' Secure;' : '';
   return {
-    'set-cookie': `${COOKIE_NAME}=${encodeURIComponent(config.auth.token)}; HttpOnly; SameSite=Strict; Path=/; Max-Age=2592000;${secure}`
+    'set-cookie': `${COOKIE_NAME}=${encodeURIComponent(config.auth.token)}; HttpOnly; SameSite=Strict; Path=/; Max-Age=${SESSION_MAX_AGE_SECONDS};${secure}`
   };
 }