Initial commit of Descrybe v2 without local scratch artifacts.

Drop one-shot tmp/axe scripts and agent i18n scratch so the Gitea tree is deployable.

apps/api/internal/auth/session.go

@@ -0,0 +1,33 @@
+package auth
+
+import (
+	"net/http"
+	"time"
+
+	"github.com/alexedwards/scs/pgxstore"
+	"github.com/alexedwards/scs/v2"
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+func NewSessionManager(pool *pgxpool.Pool, cookieName string, secure bool, idleHours int) *scs.SessionManager {
+	sm := scs.New()
+	sm.Store = pgxstore.New(pool)
+	sm.Lifetime = 7 * 24 * time.Hour
+	if idleHours <= 0 {
+		idleHours = 24
+	}
+	sm.IdleTimeout = time.Duration(idleHours) * time.Hour
+	sm.Cookie.Name = cookieName
+	sm.Cookie.HttpOnly = true
+	sm.Cookie.Secure = secure
+	sm.Cookie.SameSite = http.SameSiteLaxMode
+	sm.Cookie.Path = "/"
+	return sm
+}
+
+const (
+	SessionUserIDKey         = "user_id"
+	SessionCompanyIDKey      = "company_id"
+	SessionImpersonatorIDKey = "impersonator_id" // non-prod user switch: original admin/demo
+	SessionVersionKey        = "session_version" // must match users.session_version
+)