fix: post-M4 validation improvements

- Session: verify server-side iat expiry (not just cookie maxAge)
- Validate ProjectMemberRole on member add (reject arbitrary strings)
- Scope coverage threshold to Repository/Service layers (per guidelines)
- Add session expiry/fresh-token unit tests

tests/unit/lib/auth/session.test.ts

@@ -1,6 +1,18 @@
 import { describe, it, expect } from 'vitest';
+import crypto from 'node:crypto';
 import { createSessionToken, verifySessionToken } from '@/lib/auth/session';
 
+function forgeToken(uid: number, iat: number): string {
+  const secret = process.env.SESSION_SECRET!;
+  const payload = JSON.stringify({ uid, iat });
+  const encoded = Buffer.from(payload, 'utf-8').toString('base64url');
+  const signature = crypto
+    .createHmac('sha256', secret)
+    .update(encoded)
+    .digest('base64url');
+  return `${encoded}.${signature}`;
+}
+
 describe('session token', () => {
   it('round-trips a user id through create and verify', () => {
     const token = createSessionToken(42);
@@ -34,6 +46,15 @@ describe('session token', () => {
     expect(verifySessionToken('')).toBeNull();
   });
 
+  it('returns null for an expired token (stale iat)', () => {
+    const eightDaysAgo = Date.now() - 8 * 24 * 60 * 60 * 1000;
+    expect(verifySessionToken(forgeToken(42, eightDaysAgo))).toBeNull();
+  });
+
+  it('accepts a freshly-issued token', () => {
+    expect(verifySessionToken(forgeToken(42, Date.now()))).toBe(42);
+  });
+
   it('returns null when the payload uid is not a number', () => {
     const encoded = Buffer.from(
       JSON.stringify({ uid: 'not-a-number', iat: Date.now() })