Increase JWT access token expiry beyond 15 minutes

[ALeonard9]

Story

As Adam running extended local dev/testing sessions, I want the access token to stay valid much longer than 15 minutes, so that routine testing doesn't get interrupted by silent 401s mid-session.

Acceptance Criteria

• ACCESS_TOKEN_EXPIRE_MINUTES (settings.access_token_expire_minutes) is increased well beyond the current 15-minute default — Adam's ask is "much longer"; a reasonable target is measured in hours, not minutes (implementer's call on the exact value).
• Confirm this doesn't weaken any explicit security assumption elsewhere in the codebase that depends on a short-lived access token (re-check app/auth/oauth2.py and anywhere else referencing the 15-minute window).
• Implementer's call whether prod should differ from local/dev — a separate, shorter prod value is a legitimate outcome if there's a reason to keep prod tighter; the ask driving this ticket is specifically about local dev sessions dying mid-work.

Context

Raw capture: "File a ticket for a much longer access token." Discovered today (2026-08-04) during manual testing of web#157/api#299 — after roughly an hour with the local dev stack up, /api/visibility started 401ing, surfacing to the user as "Could not load privacy settings" in Privacy Settings. Root cause traced to ACCESS_TOKEN_EXPIRE_MINUTES defaulting to 15 (app/auth/oauth2.py:100). A fresh sign-in resolved it immediately, confirming no functional regression from other work in flight — just an inconveniently short-lived token for anything beyond a quick session.

Channel Impact

• API: in this issue
• Web: no impact — the web app doesn't set the expiry, it just receives 401s when the token lapses
• iOS: no impact — same as web, consumes whatever the API issues
• MCP: no impact — MCP auth uses API keys (API_TOKEN/API_EMAIL+API_PASSWORD), not this access-token flow

Estimate

• Recommended model: Haiku 4.5 — a config value change
• Human effort: S — one quick decision on the actual new duration, plus a review pass