Remote session lifetime (#648) refuses HALT too: a keel serve --external-host console can't halt after 12h until restarted #983

Raised by the PR #977 security review (round 2). Decision needed from the owner; not changed in #977.

What changes when #977 lands

Before #977, serve() dropped external_hosts and started_at (#971), so the #648 remote session lifetime was never enforced. #977 restores it as designed: on a server started with --external-host, ServeConfig.session_expired_at = start + REMOTE_SESSION_MAX_AGE_SECONDS, and the admission check in keel/web/server.py refuses EVERY request after that with 403 "Session expired". That includes POST /api/gates/halt, and it includes loopback clients.

Why it matters

keel/web/gates.py: "stopping must never be slower than starting". A console left running past the lifetime shows the expired-session refusal instead of Pulse, so HALT is unreachable from the browser until someone restarts keel serve at a terminal (keel halt at the CLI still works).

Options

1. Keep as is (the lifetime is the point of keel link prerequisite: the remote-exposure security pass — bind opt-in, tunnel Host validation, token issuance off loopback #648; a leaked token must not halt either), and say so on the refusal page ("use keel halt at a terminal").
2. Exempt the halt route from the lifetime (still requiring the halt token): a leaked token could then halt, which is recoverable by keel resume, never release.
3. Add a re-mint flow so a long-running remote console can renew without a restart.

Cost of leaving it: an operator using a tunnel can lose the browser HALT after 12 h without noticing until they need it.