fix: IDEAS.md quickfixes — idle-timeout app config, id_token out of Claims, FormEvent import

session.idle_timeout (minutes, default 15) joins the app-config registry
and drives the onboarding Garmin session eviction, distinct from
session.duration (the login cookie lifetime in hours). The raw Keycloak
ID token no longer rides in auth.Claims through every request context:
it's minted into the session cookie separately and read back only by the
logout handler via IDTokenFromSessionCookie. OnboardingWizard uses the
type-imported FormEvent<HTMLFormElement> instead of the React.FormEvent
namespace alias.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/IDEAS.md

@@ -7,11 +7,6 @@ writing-plans flow (see `docs/superpowers/specs/` and `docs/superpowers/plans/`
 for that history) and remove it from here once a spec exists.
 
 ## Backlog
-- quickfixes
-  - make setupSessionIdleTimeout an application configuration (key session.idle_timeout), check difference with appCfg.SessionDuration
-  - don't put id_token in Claim, store it in the cookie apart from Claim
-  - find alternative to deprecated React.FormEvent
-  - replace all standard go log calls by our application logger, 
 - new workout kinds
   - add "Recovery", "Quick", and "Sprint" workout kinds
   - order to follow (in activities page filter buttons, in analysis page combobox, in profile page workout kinds cards) is Recovery -> Easy -> Long -> Tempo -> 60' Threshold -> 30' Threshold -> Quick -> Intervals -> MAS Test -> Sprint -> Race
@@ -77,4 +72,3 @@ for that history) and remove it from here once a spec exists.
 ## Someday / maybe
 
 - training programs with phases (tapering, easier weeks, post-race recovery)
-- improve logs (add non-REST logs, make python generate JSON logs through stdout, adapt go<->python protocol)