Add viewer-range categories, nomination tracking, dynamic showact form, session timeout, share URLs, and workflow-per-season

Features:
- Category viewer ranges + subcategory templates (admin group modal, tree workspace)
- Nomination enrichment via TwitchTracker API (NominationEnrichmentService,
  TwitchTrackerViewerStatsProvider) with admin tracking rules editor
- Nomination group tracker: CategoryGroupName as primary identifier,
  CategoryId stays as nullable legacy field; StreamerIdentity table
- Dynamic showact application form builder (AdminShowactFormBuilder,
  ShowactApplicationSchedule)
- Session idle timeout setting (AdminSessionTimeoutCard)
- Share URLs for X and Discord (SiteSettings, public extras)
- Workflow rules now stored per season (falls back to global SiteSettings)
- New admin routes: settings/access, settings/workflows, tracking-rules
- New admin review workspace with subcategory tabs
- AdminCategoriesView rebuilt with group/subcategory modals

Migrations (all additive):
- AddShareUrls, AddShowactDynamicForm, AddCategoryViewerRanges,
  AddSessionIdleTimeoutSettings, AddSeasonSubcategoryTemplates,
  AddNominationGroupTrackerIdentity, AddShowactApplicationSchedule,
  AddSeasonWorkflowRulesJson

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Backend/Endpoints/AuthSessionEndpoints.cs

@@ -19,7 +19,7 @@ public static partial class AuthEndpoints
             return Results.Unauthorized();
         }
 
-        return Results.Ok(await ToAuthSessionDtoAsync(db, session, false, context.RequestAborted));
+        return Results.Ok(await ToAuthSessionDtoAsync(db, userSessionService, session, false, context.RequestAborted));
     }
 
     private static async Task<IResult> Logout(HttpContext context, IUserSessionService userSessionService)
@@ -36,6 +36,7 @@ public static partial class AuthEndpoints
 
     private static async Task<AuthSessionDto> ToAuthSessionDtoAsync(
         AwardsDbContext db,
+        IUserSessionService userSessionService,
         UserSession session,
         bool mustChangePassword = false,
         CancellationToken cancellationToken = default)
@@ -43,12 +44,14 @@ public static partial class AuthEndpoints
         var teamMember = await FindTeamMemberForSessionAsync(db, session, cancellationToken);
         var sessionRole = teamMember?.Role ?? session.Role;
         var permissionKeys = await AdminPermissionCatalog.GetPermissionKeysAsync(db, sessionRole, cancellationToken);
+        var sessionIdleTimeoutHours = await userSessionService.GetIdleTimeoutHoursAsync(cancellationToken);
         return new(
             session.SessionToken,
             session.TwitchUserId,
             teamMember?.DisplayName ?? session.DisplayName,
             AdminRoles.Normalize(sessionRole),
             permissionKeys,
+            sessionIdleTimeoutHours,
             teamMember?.MustChangePassword ?? mustChangePassword,
             teamMember?.Login,
             teamMember?.BoundTwitchUserId,