Extend authentik + FreshRSS session lifetimes

Authentik's default-authentication-login stage ships with
session_duration: seconds=0, so the SSO session died with the browser.
New blueprint raises it to 30 days for every app on that flow.

FreshRSS runs OIDC through Apache mod_auth_openidc, whose defaults are a
5 minute inactivity timeout and a ~7.5 hour max duration in a non-persistent
cookie. Bumped to a 30 day sliding inactivity window (refreshed on every
request) with a 90 day hard cap, and made the cookie persistent so it
survives a browser restart.

freshrss/freshrss-deployment.yaml

@@ -56,6 +56,20 @@ spec:
               value: "openid email profile"
             - name: OIDC_X_FORWARDED_HEADERS
               value: X-Forwarded-Port X-Forwarded-Proto X-Forwarded-Host
+            # Session handling for the Apache mod_auth_openidc layer that guards /i/.
+            # Defaults are 5 min inactivity / ~7.5 h max, which is what caused the
+            # constant bounces back to authentik.
+            # Sliding window: refreshed on every request, so any visit within the
+            # period extends it by another 30 days.
+            - name: OIDC_SESSION_INACTIVITY_TIMEOUT
+              value: "2592000" # 30 days
+            # Hard cap, counted from login and never extended.
+            - name: OIDC_SESSION_MAX_DURATION
+              value: "7776000" # 90 days
+            # ":persistent" makes the session cookie survive a browser restart
+            # (its expiry tracks OIDC_SESSION_INACTIVITY_TIMEOUT).
+            - name: OIDC_SESSION_TYPE
+              value: "server-cache:persistent"
             - name: TZ
               value: Europe/Amsterdam
           image: freshrss/freshrss:latest