feat(auth): keep remember tokens on session timeout

- add timeout-specific logout path without remember-token revocation

- reset session timers after remember-me auto login

- compact session policy wording in admin settings (DE/EN)

- extend auth tests for timeout/manual logout behavior

pages/admin/settings/index(default).phtml

@@ -334,7 +334,6 @@ $disabledAttr = $isReadOnly ? 'disabled' : '';
               <?php e(t('Session limits define how long logged-in users stay signed in.')); ?>
             </blockquote>
             <small class="muted"><?php e(t('Idle timeout signs users out after no activity.')); ?></small>
-            <small class="muted"><?php e(t('Absolute timeout signs users out after total session duration, even with activity.')); ?></small>
             <small class="muted"><?php e(t('New limits apply on each user\'s next request.')); ?></small>
             <div class="grid">
               <label class="app-field">