feat(260610-k1z-01): wire persistSessionCookie into index.ts + add unit tests

- Mount persistSessionCookie() immediately after oidcAuthMiddleware() inside !devBypassActive block
- Test A: truthy oidcAuthJwt produces Set-Cookie with Max-Age, SameSite=Lax, HttpOnly, Secure
- Test B: falsy/absent oidcAuthJwt emits no oidc-auth cookie (no-resurrection guard)

apps/api/src/index.ts

@@ -11,6 +11,7 @@ import { listsRouter, listItemsRouter } from './routes/lists.js'
 import { pushRouter } from './routes/push.js'
 import { oidcAuthMiddleware, processOAuthCallback } from './auth/middleware.js'
 import { devAuthBypass } from './auth/devBypass.js'
+import { persistSessionCookie } from './auth/persistSessionCookie.js'
 import { startBrokerPoller } from './broker/poller.js'
 import { startOutboxWorker } from './broker/outboxWorker.js'
 import { startReminderScheduler } from './broker/reminderScheduler.js'
@@ -49,6 +50,8 @@ app.use('/api/*', devAuthBypass())
 // redirect_uri (Pitfall 1). Set it to https://familysync.<domain>.
 if (!devBypassActive) {
   app.use('/api/*', oidcAuthMiddleware())
+  // Re-issues the session-scoped oidc-auth cookie as persistent so PWA sessions survive close (AUTH-02).
+  app.use('/api/*', persistSessionCookie())
 }
 
 // Protected API routes (behind oidcAuthMiddleware)