Feature: configurable backend session timeout

[cursor]

Summary

• Backend session timeout currently fixed, unlike front-end keep-alive options.
• Security team requests ability for customers to tune timeout values per environment.
• Implement configurable backend session timeout exposed via standard configuration property.

Context

Slack request from security channel (Mehdi Karimi) noted that only front-end keep alive exists today (https://dev.dotcms.com/docs/request-response-and-session#SessionKeepAlive). Customers using the OWASP plugin cannot adjust backend session expiry in core and need native support to align with their policies.

Acceptance Criteria

• Add configuration property (e.g., SESSION_TIMEOUT_MINUTES) with sensible default matching current behavior.
• Document how admins can set the value (docs + release notes).
• Ensure timeout propagates through backend session management (login, admin UI, REST).
• Include automated tests covering default and custom values.

Additional Notes

• Coordinate with security reviewers to validate defaults.
• Consider backward compatibility for existing installations.