Round 3: session longevity, in-chat tone, pin audit, older-msg loader, long-press sheet, draft fix

Session (New): stop the ~24h auto-logout. SESSION_TTL 24h -> 90d, and /api/me now
    SLIDES the session forward + re-stamps the cookie on every app load / focus /
    6h heartbeat — so an actively-used session never lapses; you only log out by
    choosing to. Login no longer depends on "remember me".
#2  A new message in the chat you're actively viewing now plays a soft, distinct
    in-chat tone (playMsgTone) — no popup — instead of being silent. A different
    chat / a backgrounded chat still gets the alert ping + notification.
#13 Pin/unpin is now written to the audit log (actor + which message, and whose pin
    was removed on an unpin) — the accountability gap when anyone can unpin.
Pagination: a floating "Loading earlier messages…" pill now shows while older
    history is being fetched (loadOlder had no visible indicator).
#9  Mobile long-press now opens a dimmed + blurred bottom ACTION SHEET (quick
    reactions + reply/edit/forward/copy/pin/delete) instead of the flaky hover-style
    reveal that hid behind images and broke after the lightbox opened.
#14 editTarget is cleared on conversation switch — starting an edit then switching
    chats used to leave editTarget set, which silently stopped ALL draft saving.
    Also added Edit to the shared action list so mobile long-press can edit too.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/config.js

@@ -70,6 +70,9 @@ module.exports = {
   TRANS_DIR,
   UPLOADS_DIR,
   DOWNLOADS_DIR,
-  SESSION_TTL: 1000 * 60 * 60 * 24, // 24h access-token / cookie lifetime
+  // Access-token / web-cookie lifetime. Long by design + SLID FORWARD on every /api/me (app load / focus /
+  // heartbeat), so an actively-used session never lapses — you only get logged out by choosing to log out.
+  // (Was 24h, which logged people out overnight.)
+  SESSION_TTL: 1000 * 60 * 60 * 24 * 90, // 90d
   REFRESH_TTL: 1000 * 60 * 60 * 24 * 90, // 90d refresh-token lifetime (native clients)
 };