fix(core): respect rememberMe flag for session persistence

[klaudia-blazyczek-blurify]

Summary

Fixed sessions incorrectly persisting after browser close regardless of "Remember me" checkbox state. Sessions now respect the rememberMe flag: unchecked → session-only (cleared on browser close), checked → 30-day persistent.

Changes

• core (pam/identity module):
  • auth.ts: Removed hardcoded rememberMeDuration config that forced all sessions to 30-day persistence
  • identity.service.ts: Modified forwardCookies() to conditionally set Max-Age header based on rememberMe flag passed from login handler

Acceptance criteria

• Without "Remember me" → session-only cookie (no Max-Age), cleared on browser close
• With "Remember me" → persistent cookie (Max-Age=2592000 / 30 days)
• rememberMe flag flows correctly: UI → oRPC → identity service → cookie headers
• No changes needed in BetFeel consumer (already sends rememberMe correctly)

Checklist

• pnpm verify is green (typecheck + lint + boundaries + module-shape + tests)
• pnpm verify:drift is green (catalog / OpenAPI not stale)
• No cross-module boundary violations
• No new tables
• No secrets or player data added

Notes

• Manual testing recommended: Check cookie Max-Age in DevTools (F12 → Application → Cookies)
  • Login without "Remember me" → auth_token should have NO Max-Age / Expires
  • Login with "Remember me" → auth_token should have Max-Age: 2592000
• No breaking changes; purely fixes incorrect behavior