Idle sessions sign themselves out; a KVM's login is remembered; the compose editor knows YAML

A session unused for seven days is dropped, the Sessions list marks a day's idleness and
can sign all of those out at once. The hub keeps a KVM's own cookies from any browser that
has them and lends them to one that hasn't, on the wire and back to the page. The stack
editor and the new-stack dialog use CodeEditor: line numbers, YAML and .env colour under a
real textarea, Tab/Shift+Tab/Enter indentation, and a key bar on touch screens.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

internal/api/users.go

@@ -12,6 +12,7 @@ import (
 	"io"
 	"log"
 	"net/http"
+	"strconv"
 	"strings"
 	"time"
 
@@ -264,6 +265,29 @@ func (s *Server) revokeSession(w http.ResponseWriter, r *http.Request) {
 	w.WriteHeader(204)
 }
 
+// revokeIdleSessions drops the caller's sessions that have not been used for ?hours (24 by
+// default): the scripts and headless browsers that signed in once and never came back,
+// without touching the phone that was used this morning.
+func (s *Server) revokeIdleSessions(w http.ResponseWriter, r *http.Request) {
+	a := actorOf(r)
+	if a.User == "" {
+		jsonErr(w, 403, "only a signed-in user may do that")
+		return
+	}
+	hours := 24
+	if h := r.URL.Query().Get("hours"); h != "" {
+		n, err := strconv.Atoi(h)
+		if err != nil || n < 1 || n > 24*365 {
+			jsonErr(w, 400, "hours is a whole number from 1 to 8760")
+			return
+		}
+		hours = n
+	}
+	n := s.sessions.RevokeIdle(a.User, a.token, time.Duration(hours)*time.Hour)
+	log.Printf("%d idle session(s) of %q revoked (idle > %dh, by %s)", n, a.User, hours, clientIP(r))
+	jsonOK(w, 200, map[string]int{"revoked": n})
+}
+
 func (s *Server) revokeOtherSessions(w http.ResponseWriter, r *http.Request) {
 	a := actorOf(r)
 	if a.User == "" {