feat(auth): org session policies — lifetime/idle limits, org-wide revocation (#5862)
* feat(auth): org session policies — lifetime/idle limits, org-wide revocation, cookie-cache versioning
* refactor(auth): consolidate session-policy clamp semantics, shared security-policy version module, canonical bounds, docs
* polish(session-policy): cleanup pass — muted field labels, spinner reset, state tracker, response-seeded baseline, comment trims
* fix(session-policy): govern member sessions by membership (closes revoke cookie-cache hole), normalize createdAt, remount on org switch, sync audit mock
* fix(session-policy): clamp pre-join sessions on invite acceptance, normalize expiresAt, sync unified nav test
* fix(session-policy): invalidate membership cache on removal/transfer, spare impersonator sessions in revoke-all, raise idle floor to 2x cookie window
* fix(session-policy): resolve governing org by membership only — activeOrganizationId goes stale across transfer/leave
* fix(session-policy): atomic policy save + eager clamp, asymmetric membership TTL, admin-add cache invalidation
* fix(session-policy): org-scoped cookie version string, atomic revoke delete+bump
* fix(session-policy): plan-gate effective policy so downgraded orgs stop enforcing automatically
* chore(session-policy): drop dead bumpSecurityPolicyVersion helper — call sites bump transactionally
* fix(session-policy): unify join paths on applySessionPolicyToNewMember; final audit polish (dead exports, response bound, test name)
Waleed
2b5a92a3c8