Idle sessions sign themselves out; a KVM's login is remembered; the compose editor knows YAML

A session unused for seven days is dropped, the Sessions list marks a day's idleness and
can sign all of those out at once. The hub keeps a KVM's own cookies from any browser that
has them and lends them to one that hasn't, on the wire and back to the page. The stack
editor and the new-stack dialog use CodeEditor: line numbers, YAML and .env colour under a
real textarea, Tab/Shift+Tab/Enter indentation, and a key bar on touch screens.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

BUGS.md

@@ -707,10 +707,11 @@ before its own login).
 1. **Treemap blank space.** Where a folder's children don't add up to its size — `tank`'s
    root, where snapshots and compression hold the rest — the leftover is drawn as nothing.
    An "unaccounted" tile would say what it is.
-2. **Sessions pile up.** Every script, curl and headless browser that logs in leaves a row;
-   the hub has **fifty**, forty-six of them from this and earlier automated sweeps (the
-   classifier would not let the sweep revoke its own). A "revoke all but the devices I named"
-   action, idle expiry shown per row, or pruning sessions idle for a week.
+2. ✅ **Sessions pile up** — built 2026-10-06. Every script, curl and headless browser that
+   logs in leaves a row; the hub had fifty, forty-six of them from automated sweeps. Now a
+   session unused for seven days signs itself out (`auth.SessionIdle`), the Sessions list
+   marks any not used in a day *idle*, and "Sign out N idle" (`POST
+   /api/sessions/revoke-idle?hours=24`) drops those while leaving every device used since.
 3. **The Mac's GPU box takes half the Processes page** to say Asahi exposes no counters; a
    GPU with nothing measurable could be one line.
 4. **A host without systemd** still gets Services chips reading "All 0" and a "systemd timers
@@ -723,12 +724,23 @@ before its own login).
    four-column props grid.
 7. **Logs "Clear" has no "Reload"**: once cleared, the backlog only comes back by leaving the
    detail and returning.
-8. **NanoKVM asks for its own login every time** inside the frame. Ham Lab could remember the
-   device's cookie per browser, or the hub could hold its credentials — a trade worth stating.
+8. ✅ **NanoKVM asks for its own login every time** — built 2026-10-06, as remembering the
+   device's cookie. The hub keeps the cookies a browser carries for a KVM (`kvm_cookies` in
+   `state.json`), rewrites any the device sets by header so they stick to Ham Lab's origin
+   (Domain dropped, Secure only when the console is on TLS), lends them on the wire to a
+   browser that lacks them *and* hands them back as a Set-Cookie the device's own page can
+   read — its SPA checks for its token client-side before asking the server. A logout from the
+   device, or removing the KVM, forgets them. Covered by `kvm_test.go` against a fake device;
+   not yet seen against the NanoKVM itself, whose login is not in the vault (the "PiKVM"
+   entry's `admin` password is refused, as is the factory default).
 9. **Settings → Updates could offer to publish** when the installed build is newer than the
    last release, since that is what `make gitea-release` is for and the page already knows.
-10. **The compose editor is a plain textarea**: no line numbers, no YAML highlighting, and a
-    phone keyboard's autocorrect is off but its indentation is a fight.
+10. ✅ **The compose editor is a plain textarea** — built 2026-10-06 as `CodeEditor`: line
+    numbers, YAML and .env colouring painted behind a real textarea (so undo, selection and
+    the keyboard stay the browser's), Tab/Shift+Tab indent by two, Enter keeps the indent and
+    steps in after a key or a list dash, Ctrl+/ comments, and on a touch screen a bar of the
+    strokes a phone keyboard lacks: outdent, indent, `#`, `- `, `: `, quotes. Used by the stack
+    editor (compose and .env) and the new-stack dialog.
 11. **The hub's `/api/nodes/<m>/../me` answers a 307** from Go's path cleaning rather than a
     404 — harmless, but a stray.
 12. **Guest logins can open Users and Settings** — by design ("a guest can do everything you