fix: webpool containers now stay alive 24h; recycle on session expiry

- Pool containers got IDLE_TIMEOUT=86400 instead of SESSION_IDLE_SECONDS (300s)
  to prevent them from cycling every 5 minutes while idle
- On session expiry, WEBPOOLIDX containers are now stopped so ensure_web_pool()
  recreates them fresh for the next user (prevents dirty Chromium state)

app/maintenance.py

@@ -23,6 +23,7 @@ from runtime import (
     ensure_web_pool,
     start_rdp_slot_container,
     stop_runtime_container,
+    web_pool_container_name,
 )
 
 logger = logging.getLogger("portal")
@@ -58,10 +59,16 @@ def cleanup_loop():
                         rdp_slots_to_restart.append(int(cid.split(":", 1)[1]))
                     except Exception:
                         pass
+                elif cid.startswith("WEBPOOLIDX:"):
+                    try:
+                        slot = int(cid.split(":", 1)[1])
+                        stop_runtime_container(web_pool_container_name(slot))
+                    except Exception:
+                        logger.exception("webpool_slot_recycle_failed cid=%s", cid)
                 elif cid and not (
                     cid.startswith("POOL:")
                     or cid.startswith("POOLIDX:")
-                    or cid.startswith("WEBPOOLIDX:")
+                    or cid.startswith("RDPSLOT:")
                 ):
                     stop_runtime_container(cid)
                 sess.status = SessionStatus.EXPIRED

app/runtime.py

@@ -145,7 +145,7 @@ def ensure_web_pool(target_size: Optional[int] = None) -> None:
             "portal.pool.slot": str(i),
         }
         env = {
-            "IDLE_TIMEOUT": str(SESSION_IDLE_SECONDS),
+            "IDLE_TIMEOUT": "86400",
             "ENABLE_HEARTBEAT": "0",
             "SESSION_ID": f"webpool-{i}",
             "X11VNC_FLAGS": X11VNC_FLAGS,