Extend authentik + FreshRSS session lifetimes

Authentik's default-authentication-login stage ships with
session_duration: seconds=0, so the SSO session died with the browser.
New blueprint raises it to 30 days for every app on that flow.

FreshRSS runs OIDC through Apache mod_auth_openidc, whose defaults are a
5 minute inactivity timeout and a ~7.5 hour max duration in a non-persistent
cookie. Bumped to a 30 day sliding inactivity window (refreshed on every
request) with a 90 day hard cap, and made the cookie persistent so it
survives a browser restart.

apps/templates/authentik-helm.yaml

@@ -106,6 +106,9 @@ spec:
               - name: blueprint-actualbudget
                 configMap:
                   name: authentik-blueprint-actualbudget
+              - name: blueprint-session
+                configMap:
+                  name: authentik-blueprint-session
             volumeMounts:
               - name: blueprint-vault
                 mountPath: /blueprints/custom/vault-oidc.yaml
@@ -125,6 +128,9 @@ spec:
               - name: blueprint-actualbudget
                 mountPath: /blueprints/custom/actualbudget-proxy.yaml
                 subPath: actualbudget-proxy.yaml
+              - name: blueprint-session
+                mountPath: /blueprints/custom/session-duration.yaml
+                subPath: session-duration.yaml
             ingress:
               enabled: true
               ingressClassName: nginx
@@ -156,6 +162,9 @@ spec:
               - name: blueprint-actualbudget
                 configMap:
                   name: authentik-blueprint-actualbudget
+              - name: blueprint-session
+                configMap:
+                  name: authentik-blueprint-session
             volumeMounts:
               - name: blueprint-vault
                 mountPath: /blueprints/custom/vault-oidc.yaml
@@ -175,6 +184,9 @@ spec:
               - name: blueprint-actualbudget
                 mountPath: /blueprints/custom/actualbudget-proxy.yaml
                 subPath: actualbudget-proxy.yaml
+              - name: blueprint-session
+                mountPath: /blueprints/custom/session-duration.yaml
+                subPath: session-duration.yaml
           postgresql:
             enabled: false
           redis: