OIDC: Make the sign-in session duration configurable

As someone running PhotoPrism with an external identity provider, I want to control how long a sign-in stays valid, so that the people using my instance are not asked to sign in again more often than my setup needs.

Signing in through an identity provider currently creates a session that ends after a fixed amount of time, and it ends at that point even while the session is actively being used. The session duration settings an administrator can already configure apply to sign-ins with a username and password, so adjusting them does not change how long a sign-in through an identity provider lasts.

For many instances the current behavior is a good fit, and a shorter session is often preferable: the sooner a session ends, the sooner a change made at the identity provider — such as disabling an account — takes effect. For others it is disruptive. On a family instance at home, or where people keep the app open throughout the day, everyone is signed out on a fixed schedule, and the configured session settings suggest that should not be happening.

The aim is to let administrators choose a duration that suits their instance, while keeping today's behavior for anyone who does not change anything.

Worth knowing for administrators hitting this today: how often you actually have to type a password also depends on your identity provider. Most can keep you signed in across sessions, in which case PhotoPrism's session is renewed in the background without a sign-in prompt. Adjusting that setting is often the quicker fix, and it keeps the identity provider in control of how long access lasts.

Acceptance Criteria

• MUST allow administrators to configure how long a sign-in through an identity provider remains valid.
• MUST keep the current duration as the default, so instances behave exactly as before after an update unless the setting is changed.
• MUST document which session settings apply to which sign-in methods, so the behavior is clear from the documentation alone.
• SHOULD keep sessions bounded by default, so that account changes made at the identity provider take effect within a predictable time.
• SHOULD explain in the documentation that the identity provider's own settings also affect how often people are prompted to sign in.
• MAY allow the inactivity timeout for these sign-ins to be configured as well.