0.2.40

server/README.md

@@ -324,13 +324,13 @@ maintenance switch and row engagement. Set `MEMBY_ADMIN_TOKEN` to enable it; uns
 `/admin` route 404s so it cannot be left exposed by accident. The page first uses the same
 discreet Emby login gate as the private installer. After successful verification it
 establishes the HttpOnly admin cookie, but browser API requests require both that cookie
-and the current 30-minute Emby-verified session. The old admin cookie therefore cannot
+and the current 12-hour Emby-verified session. The old admin cookie therefore cannot
 bypass the gate after the browser session expires. Scripts may continue to use
 `Authorization: Bearer <MEMBY_ADMIN_TOKEN>` without a browser session.
 
-That 30 minutes is idle time, not a hard limit: opening an admin page, making any change,
+Those 12 hours are idle time, not a hard limit: opening an admin page, making any change,
 or reading one while interacting with it slides the expiry forward once it is inside the
-last fifteen minutes. What deliberately does **not** extend it is the page's own status
+last six hours. What deliberately does **not** extend it is the page's own status
 poll — a console left open on a second monitor still times out, which is the whole point
 of the TTL. The page marks its own requests with `X-Memby-Admin-Active` when there has
 been interaction in the last five minutes, and on a 401 it reloads, so an expiry lands as
@@ -339,6 +339,7 @@ the sign-in form with `next` pointing back at the page rather than as an error b
 | Method | Path | Purpose |
 | --- | --- | --- |
 | GET | `/admin/` | The page |
+| POST | `/admin/logout` | End the browser admin session |
 | GET | `/admin/api/status` | Library counts, sync history, maintenance state |
 | GET | `/admin/api/runtime` | Protected Go heap, memory-limit and goroutine metrics |
 | POST | `/admin/api/sync` | `{"kind":"full"}` or `{"kind":"incremental"}` |