Problem

The /agents PWA logs users out frequently when the app is backgrounded or swiped away, even though the normal site doesn't.

Root Cause

The coder_session_token cookie was created without Expires or MaxAge, making it a transient session cookie that only lives in memory:

return api.DeploymentValues.HTTPCookies.Apply(&http.Cookie{
    Name:     codersdk.SessionTokenCookie,
    Value:    sessionToken,
    Path:     "/",
    HttpOnly: true,
    // no Expires or MaxAge
})

• Normal browser: Session cookies persist because the browser process rarely fully terminates, and modern browsers restore them on restart.
• Standalone PWA (display: standalone): Runs in its own isolated browser process. When mobile OSes kill that process (user swipes the app away), in-memory cookies are purged — forcing re-login even though the server-side API key is still valid (default 24h, refreshed on activity).

Fix

Set MaxAge on the cookie to match the API key's LifetimeSeconds, making it a persistent cookie written to disk.

This is safe because:

• The server already validates ExpiresAt on every request
• The server already refreshes expiry on activity (unless DisableSessionExpiryRefresh is set)
• The security model is unchanged — MaxAge only controls whether the browser writes the cookie to disk vs. keeping it in memory