Long-lived rider JWT for designated lab seats

[ceedot-rock]

What changed

Adds RIDER_LONG_LIVED_AGENT_IDS (comma-separated agent_ids). Seats listed there get a 10-year rider JWT TTL — effectively unending while keeping the exp claim so verifiers stay happy; revocation via JWKS still works. Every other seat keeps the 15-minute default. issueRider keeps its explicit ttlSeconds override, which still wins when passed.

Components touched

• src/lib/rider.ts (only)

Checks

• No call-site changes — all 7 issueRider(...) callers use the single-arg form; the new optional param is backward compatible
• No keys, tokens, or secrets added (env var holds agent IDs only, values set in deploy env)
• No public API surface change (same response shape, expires_in just larger for listed seats)
• CI

Deploy note: set RIDER_LONG_LIVED_AGENT_IDS=<agent_id>,... in the hosting env and redeploy for this to take effect.