登录态改为同一设备 7 天内免重新登录（permanent cookie，访问滑动续期）。

Co-authored-by: Cursor <cursoragent@cursor.com>

app.py

@@ -232,6 +232,13 @@ def resolve_path(path_value):
 
 app = Flask(__name__)
 app.secret_key = os.getenv("FLASK_SECRET_KEY") or os.urandom(32)
+# 登录态：同一设备 7 天内免重新登录（permanent cookie；访问时滑动续期）
+try:
+    _SESSION_DAYS = max(1, int(os.getenv("APP_SESSION_DAYS", "7") or "7"))
+except Exception:
+    _SESSION_DAYS = 7
+app.config["PERMANENT_SESSION_LIFETIME"] = timedelta(days=_SESSION_DAYS)
+app.config["SESSION_REFRESH_EACH_REQUEST"] = True
 from lib.instance.instance_embed_lib import attach_embed_templates, redirect_to_embed_shell_if_enabled
 from lib.instance.instance_static_lib import install_common_static
 
@@ -4940,16 +4947,22 @@ def background_task():
 
 
 # ====================== 登录路由 ======================
+def _mark_logged_in():
+    session.clear()
+    session.permanent = True
+    session["logged_in"] = True
+
+
 @app.route("/login", methods=["GET", "POST"])
 def login():
     if AUTH_DISABLED:
-        session["logged_in"] = True
+        _mark_logged_in()
         return redirect("/")
     if request.method == "POST":
         username = request.form.get("username")
         password = request.form.get("password")
         if username == USERNAME and password == PASSWORD:
-            session["logged_in"] = True
+            _mark_logged_in()
             return redirect("/")
         else:
             flash("账号或密码错误")