Add optional 30-day remembered sessions

docs/guides/authentication.md

@@ -76,9 +76,30 @@ passwords created or reset by administrators must be changed before any fleet
 access. Password changes require the current password.
 
 Sessions use random tokens in HTTP-only cookies, with only token hashes stored in
-SQLite. HTTPS uses a Secure `__Host-` cookie. Sessions expire after 12 hours, or
-30 minutes without authenticated requests; background dashboard polling counts
-as activity. Login replaces the existing browser session. Logout revokes it.
+SQLite. HTTPS uses a Secure `__Host-` cookie. By default, sessions expire after
+12 hours, or 30 minutes without authenticated requests; background dashboard
+polling counts as activity.
+
+Select **Keep me signed in on this device** at sign-in to stay signed in for
+30 days, including between visits from a phone's home-screen app. This option is
+unchecked by default and applies only to that browser or home-screen app. Remembered
+sessions have no inactivity timeout, but still expire 30 days after sign-in;
+activity does not extend that deadline. Use this option only on a device you trust.
+Existing sessions keep their original limits after upgrading.
+
+Password changes always require the current password. Remembered administrator
+sessions also require the administrator's current password when creating accounts
+or editing users, including access changes and password resets. A successful
+password change replaces the current session, preserving its remember-device
+choice with a fresh lifetime, and revokes all other sessions.
+
+For API clients, `POST /api/auth/login` accepts an optional boolean `rememberMe`
+(omitted or `false` keeps the default limits). When using a remembered session,
+`POST /api/users` and `PATCH /api/users/:id` require the administrator's password
+in `currentPassword`; the `password` field remains the target user's temporary
+password. The password-change endpoint preserves the current session's choice.
+
+Login replaces the existing browser session. Logout revokes it.
 Changing a password, changing a role, disabling an account, or revoking that
 user's sessions invalidates their existing sessions. Live event streams check
 revocation every 15 seconds and then close.