Fix: Admin session now ends when closing browser

Changed admin session cookie from persistent (7-day maxAge) to session cookie
(expires when browser closes). Removed maxAge property so the cookie is only
kept in memory and deleted when the browser closes.

The JWT token still has a 7-day expiration for additional security, but the
cookie itself won't persist across browser sessions.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

src/lib/adminAuth.ts

@@ -4,7 +4,7 @@ import { cookies } from 'next/headers';
 import { prisma } from '@/lib/prisma';
 
 export const ADMIN_SESSION_COOKIE = 'admin_session';
-const SESSION_DURATION_SECONDS = 60 * 60 * 24 * 7; // 7 days
+const TOKEN_DURATION_SECONDS = 60 * 60 * 24 * 7; // 7 days (JWT expiry)
 
 // Entirely separate from customer auth (src/lib/auth.ts) — different cookie,
 // different secret, no shared code path. Logging into one never grants access
@@ -20,7 +20,7 @@ export async function createAdminSession() {
   const token = await new SignJWT({ role: 'admin' })
     .setProtectedHeader({ alg: 'HS256' })
     .setIssuedAt()
-    .setExpirationTime(`${SESSION_DURATION_SECONDS}s`)
+    .setExpirationTime(`${TOKEN_DURATION_SECONDS}s`)
     .sign(adminSecretKey());
 
   cookies().set(ADMIN_SESSION_COOKIE, token, {
@@ -28,7 +28,6 @@ export async function createAdminSession() {
     secure: process.env.NODE_ENV === 'production',
     sameSite: 'lax',
     path: '/',
-    maxAge: SESSION_DURATION_SECONDS,
   });
 }