fix: wire session_ttl config into Rack session cookie expiration

The admin.session_ttl value was defined in defaults, template, and
documentation but never read — sessions had no expiration. Pass it as
expire_after to Rack::Session::Cookie. A value <= 0 means persistent
(until browser close), matching the documented behaviour.

lib/volumen/server.rb

@@ -23,10 +23,12 @@ module Volumen
     # Returns a configured subclass bound to a specific config + store.
     def self.configured(config:, store:)
       secret = session_secret(config)
+      ttl = config.admin["session_ttl"].to_i
+      ttl = nil if ttl <= 0
       Class.new(self) do
         set :volumen_config, config
         set :volumen_store, store
-        set :sessions, httponly: true, same_site: :strict
+        set :sessions, httponly: true, same_site: :strict, expire_after: ttl
         set :session_secret, secret
       end
     end