Unit tests for signSession and verifySession #104

What

signSession and verifySession in lib/auth.ts issue and check the portal's session tokens.

There are no tests for it yet.

Cover at least

• sign then verify gives back the same claims
• undefined, "" and garbage → null
• a token with one character changed → null
• a token signed with a different secret → null (set process.env.JWT_SECRET inside the test and restore it afterwards)
• an expired token → null, using Vitest's fake timers (vi.useFakeTimers())

How

• Create lib/auth.test.ts next to the code. Follow the style of lib/github-auth.test.ts.
• Run npm test. Then break the code on purpose (flip a condition) and watch at least one of your tests fail. Paste that failure output in the PR description, then undo the break.
• Test behaviour through the exported function only. Don't change the source file unless you find a bug, and if you do, stop and comment on this issue first.

Size: ~30–60 lines of tests, 0 lines of source.

Taking this? Comment /assign and the bot assigns you if it's free. One issue per person at a time; comment /unassign to hand it back. That's milestone 2 of the 10 PR Journey. Setup, the checks CI runs, and how to open the PR from your fork are in CONTRIBUTING.md. Put Fixes #<this issue> in your PR description.