feat(security): add session timeout + transaction wrapping (B1)

Session timeout: configurable idle (default 30min) and absolute (default 8h)
timeouts via DB settings, enforced in web/index.php on every request.
Timestamps set at login in action layer; graceful fallback for pre-existing
sessions.

Transaction wrapping: UserAccountService.createFromAdmin/register, roles
create/edit, and permissions edit now wrap multi-step DB operations in
transactions to guarantee atomicity.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

pages/auth/microsoft/callback().php

@@ -1,5 +1,6 @@
 <?php
 
+use MintyPHP\Http\SessionStoreInterface;
 use MintyPHP\Router;
 use MintyPHP\Service\Auth\AuthServicesFactory;
 use MintyPHP\Support\Flash;
@@ -57,4 +58,7 @@ if (!($loginResult['ok'] ?? false)) {
     return;
 }
 
+$sessionStore = app(SessionStoreInterface::class);
+$sessionStore->set('session_started_at', time());
+$sessionStore->set('session_last_activity', time());
 Router::redirect('admin');