Summary

• add an explicit Expires timestamp alongside the existing MaxAge when issuing the login session cookie
• keep the change scoped to the login cookie path and extend the existing handler test to assert persistent-cookie attributes

Why

Safari on iPhone appears to stop sending the session cookie over time even though the server-side auth token remains valid. Setting both MaxAge and Expires keeps the cookie persistence behavior standards-aligned with a minimal blast radius.

Testing

• go test ./internal/web -run 'TestHandler_LoginPost_SuccessWithRateLimiter'
• go test -tags=integration . -run 'TestIntegration_Auth_LoginSessionDashboard'