fix login confusion and enforce reactive subscription after login

frontend/src/lib/components/AuthShell.svelte

@@ -4,11 +4,13 @@
 	let {
 		title,
 		subtitle,
-		children
+		children,
+		secondary
 	}: {
 		title: string;
 		subtitle?: string;
 		children?: any;
+		secondary?: any;
 	} = $props();
 </script>
 
@@ -21,6 +23,9 @@
 		{/if}
 		{@render children?.()}
 	</div>
+	{#if secondary}
+		<div class="card secondary">{@render secondary?.()}</div>
+	{/if}
 </main>
 
 <style>
@@ -64,6 +69,9 @@
 		font-size: 0.9rem;
 		line-height: 1.5;
 	}
+	.card.secondary {
+		margin-top: 1rem;
+	}
 	@media (max-width: 480px) {
 		.card {
 			padding: 1.5rem;

frontend/src/lib/components/Sidebar.svelte

@@ -44,7 +44,7 @@
 			? [{ href: `/${famSlug}/${memberName}/settings`, label: 'Settings', icon: settingsIcon }]
 			: []),
 		{
-			href: session ? '/logout' : role === 'child' ? `/${famSlug}/join` : '/login',
+			href: session ? '/logout' : '/login',
 			label: session ? 'Log out' : 'Log in',
 			icon: logoutIcon
 		}

frontend/src/lib/server/session.ts

@@ -7,7 +7,7 @@ import type { Cookies } from '@sveltejs/kit';
 // the token server-side via the layout load (pbToken) and seeds pb.authStore.
 // Secure flag is set in prod so it's only sent over HTTPS.
 export const SESSION_COOKIE = 'pb_token';
-const MAX_AGE = 60 * 60 * 24; // 24h, PB token exp is the real ceiling
+const MAX_AGE = 60 * 60 * 24 * 5; // 5 days — matches the PB users auth token duration
 
 export function setSessionCookie(cookies: Cookies, token: string) {
 	cookies.set(SESSION_COOKIE, token, {