Fix Authelia remember_me not actually keeping sessions alive

inactivity (idle timeout) was independent of remember_me and stayed at a
much shorter default (2h), so a long remember_me got silently overridden
by ordinary daily gaps between visits. install_authelia()'s template now
defaults inactivity to match remember_me, and the "Change remember me
duration" menu option now writes both keys together instead of just one.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0148pWopbt3tEKZWHYuHTb3c

CLAUDE.md

@@ -623,6 +623,25 @@ in `services/authelia.sh`) — prompts for a new duration (`12h`, `7d`,
 Sessions persist through reboots regardless of duration (Redis stores
 session state in a volume).
 
+**`inactivity` must track `remember_me`, or a long remember_me is a lie.**
+`inactivity` is a separate session field — how long a session can sit idle
+before Authelia ends it — and it is NOT extended or bypassed by the
+"Remember me" checkbox; the two are independent. Confirmed live: a user
+set `remember_me: 1y` expecting "won't be asked to log in again for a
+year," but the install default left `inactivity` at a much shorter value
+(2h at the time), so ordinary daily gaps between visits (overnight, a
+workday) ended the session on inactivity grounds well before remember_me
+ever came into play — the 1y setting was doing nothing. Fixed at both ends
+so this can't recur silently: `install_authelia()`'s own template now sets
+`inactivity: 7d`, matching its `remember_me: 7d` default instead of a
+shorter one, and `_authelia_set_remember_me()` now writes the SAME new
+duration into both keys on every change, not just `remember_me` alone. If
+you ever hand-edit `session:` instead of using the menu option, keep
+`inactivity` and `remember_me` equal — a mismatch here is exactly the bug
+above, not a valid intentional configuration. `expiration` (the cap for a
+session that never checked "Remember me") is a legitimately different,
+shorter-by-design setting and is untouched by any of this.
+
 **The config key is `remember_me`, not `remember_me_duration`.** Authelia
 renamed it in 4.38; this repo pins `4.39.20`. A stale `remember_me_duration`
 key doesn't error, Authelia just silently ignores it — confirmed against
@@ -635,7 +654,7 @@ touch this by hand instead of the menu option, the current schema is:
 session:
   secret: 'your-existing-secret'
   expiration: 1h
-  inactivity: 5m
+  inactivity: 1y
   remember_me: 1y
   cookies:
     - domain: 'example.com'