feat(auth): extend refresh TTL and keep session on transient errors

Bumps refresh token lifetime to 720h with env overrides, and stops
clearing the local session for non-401 refresh failures so users aren't
logged out by transient network blips. Adds a 60s retry timer when a
refresh fails for non-auth reasons.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

deploy/config.yaml

@@ -94,7 +94,7 @@ jwt:
   # Override via JWT_SECRET env var in .env
   secret: "change-me-in-production"
   access_ttl: 15m
-  refresh_ttl: 168h
+  refresh_ttl: 720h
 
 log:
   level: info,warn,error

deploy/docker-compose.yaml

@@ -14,6 +14,8 @@ x-app-env: &app-env
   LLM_API_KEY: ${LLM_API_KEY}
   SILICONFLOW_API_KEY: ${SILICONFLOW_API_KEY}
   JWT_SECRET: ${JWT_SECRET:-change-me-in-production}
+  JWT_ACCESS_TTL: ${JWT_ACCESS_TTL:-15m}
+  JWT_REFRESH_TTL: ${JWT_REFRESH_TTL:-720h}
   OBJECT_STORAGE_ACCESS_KEY: ${MINIO_ROOT_USER:-minioadmin}
   OBJECT_STORAGE_SECRET_KEY: ${MINIO_ROOT_PASSWORD:-minioadmin}