Work-order codes no longer overlap (#42), Materials before Heat map (#44), 60 min idle for Admin and Clerical (#45)

- Traveler: each work-order line shrinks, then clips, to fit its own box; 18 pt gap between boxes
- Work orders tab: card text wraps inside the card, smaller work order, wider cards
- Packet tabs: Materials before Heat map
- Sessions: SESSION_DESK_MINUTES (60) for Admin and Clerical lock and sign-out; /me answers
  lock_minutes and the browser's idle lock follows it

Co-Authored-By: Claude Opus 5.5 <[email protected]>

tests/server/test_sessions.py

@@ -30,7 +30,7 @@ def test_token_is_stored_only_as_hmac(pg_client: TestClient, pg_settings: Settin
 
 
 def test_idle_lock_after_lock_minutes(pg_client: TestClient, pg_settings: Settings) -> None:
-    sign_in(pg_client, "clerk.clara")
+    sign_in(pg_client, "wh.wade")
     _age(pg_settings, "UPDATE sessions SET last_seen_at = now() - interval '4 minutes'")
     r = pg_client.get("/api/account")
     assert r.status_code == 423 and r.json()["code"] == "locked"
@@ -60,7 +60,7 @@ def test_hidden_tab_locks_only_after_a_minute(pg_client: TestClient, pg_settings
 
 
 def test_idle_signout_after_idle_minutes(pg_client: TestClient, pg_settings: Settings) -> None:
-    sign_in(pg_client, "clerk.clara")
+    sign_in(pg_client, "wh.wade")
     _age(pg_settings, "UPDATE sessions SET last_seen_at = now() - interval '16 minutes'")
     r = pg_client.get("/api/auth/me")
     assert r.status_code == 401 and r.json()["code"] == "session_expired"
@@ -71,6 +71,24 @@ def test_idle_signout_after_idle_minutes(pg_client: TestClient, pg_settings: Set
         assert ended == {"reason": "idle"}
 
 
+def test_admin_and_clerical_get_desk_minutes(pg_client: TestClient, pg_settings: Settings) -> None:
+    # Issue #45: Admin and Clerical lock and sign out after 60 idle minutes, not 3 and 15
+    for login in ("clerk.clara", "clerk.leo", "admin.ann", "multi.mia"):
+        pg_client.cookies.clear()
+        sign_in(pg_client, login)
+        assert pg_client.get("/api/auth/me").json()["session"]["lock_minutes"] == 60
+        _age(pg_settings, "UPDATE sessions SET last_seen_at = now() - interval '59 minutes' WHERE revoked_at IS NULL")
+        assert pg_client.get("/api/account").status_code == 200, login
+        _age(pg_settings, "UPDATE sessions SET last_seen_at = now() - interval '61 minutes' WHERE revoked_at IS NULL")
+        r = pg_client.get("/api/auth/me")
+        assert r.status_code == 401 and r.json()["code"] == "session_expired", login
+
+
+def test_shop_screens_keep_short_minutes(pg_client: TestClient, pg_settings: Settings) -> None:
+    sign_in(pg_client, "weld.andy")
+    assert pg_client.get("/api/auth/me").json()["session"]["lock_minutes"] == 3
+
+
 def test_locked_session_does_not_stay_alive_by_polling(pg_client: TestClient, pg_settings: Settings) -> None:
     sign_in(pg_client, "clerk.clara")
     pg_client.post("/api/auth/lock")