fix(auth): race-safe first-run setup + rolling cookie max-age refresh

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/web/auth/validateSession.ts

@@ -17,6 +17,11 @@ export function validateSessionFromHeaders(
   return sessions.validateAndTouch(token);
 }
 
+export function extractSessionToken(rawCookieHeader: string | undefined): string | null {
+  if (!rawCookieHeader) return null;
+  return parseCookie(rawCookieHeader, SESSION_COOKIE_NAME);
+}
+
 function parseCookie(header: string, name: string): string | null {
   for (const part of header.split(";")) {
     const trimmed = part.trim();