Linus Rath af6cdfb997 fix: keep unsent mail through the idle and session limits, and mark a signed-out account in the switcher ...

The timers used to delete everything an account kept, unsent mail included.
They now follow the refused-login rule: sign out and hide, the next sign-in
brings it back, otherwise it goes after 30 days. A login without "Remember
me" that ends with the browser, an admin wipe and a wipe from settings don't
change.

- `wipeOnRefusedLogin` is now `wipeOnForcedSignOut`, since it also covers the
  limits. The server's `SESSION_TOO_OLD` goes the same way, as `session`.
- A refused account beside one that stays signed in shows in the switcher as
  needing sign-in, with the count and the date, and gets one toast.

Existing tests changed because the rule did: the session timer tests expected
a plain `logoutAll`, and the auth store tests expected no hook at the session
limit.

2026-11-03 16:36:13 +01:00

..

session-timeout-dialog.test.tsx

fix: show the session warning above every overlay and count the server's sign-in time

2026-10-28 03:53:56 +01:00

session-timeout-guard.test.tsx

fix: keep unsent mail through the idle and session limits, and mark a signed-out account in the switcher

2026-11-03 16:36:13 +01:00