feat(seaweedfs): expose JWT expires_after_seconds via values - #2911

Summary

The SeaweedFS upstream default JWT TTL is 10 seconds. The current Cozystack chart hardcodes the absence of expires_after_seconds in security.toml, so operators get the 10-second behaviour with no way to override.

For larger backends — most visibly Harbor's S3 backend (the s3aws registry driver against SeaweedFS' S3 frontend) — this default is too short. Blob uploads that take longer than ~10 seconds, or volume → master heartbeat / inter-process traffic on a slow link, end up seeing token has invalid claims: token is expired and the write fails. Symptom from Harbor's perspective:

POST /v2/<project>/<repo>/blobs/uploads/:
UNKNOWN: unknown error;
map[DriverName:s3aws Enclosed:map[RequestFailure:map[]]]

The corresponding SeaweedFS-side error in volume / s3 logs is wrong jwt with reason token is expired. Restarting the volume server forces re-issuing of tokens (with the same 10-second TTL), so the situation recurs.

Change

Add an optional expiresAfterSeconds block under global.seaweedfs.securityConfig.jwtSigning:

global:
  seaweedfs:
    securityConfig:
      jwtSigning:
        volumeWrite: true
        volumeRead: false
        filerWrite: false
        filerRead: false
        expiresAfterSeconds:
          volumeWrite: 3600   # 1 hour, or any positive integer
          volumeRead: 3600
          filerWrite: 3600
          filerRead: 3600

When the value is 0 (the default) the expires_after_seconds line is omitted from security.toml, preserving SeaweedFS' built-in 10-second default for backwards compatibility. When set to a positive integer, the value is emitted under the matching [jwt.*] section.

Test plan

• helm template with default values — no expires_after_seconds line emitted (current behaviour preserved).
• helm template with expiresAfterSeconds.volumeWrite: 3600 — expires_after_seconds = 3600 appears under [jwt.signing], nothing under other sections.
• Live cluster: bump to 3600, restart master + volume pods, confirm large Harbor uploads succeed and token is expired errors stop appearing in volume logs.

Reference

SeaweedFS source: weed/security/jwt.go reads expiresAfterSec and only sets the exp claim when value is positive. Scaffold (security.toml) documents the 10-second default but doesn't include a way to override via Helm-style config — that's what this PR adds at the Cozystack chart level.

Summary by CodeRabbit

• New Features
  • JWT token expiration times are now independently configurable for volume and filer operations (read/write). Default settings preserve SeaweedFS's built-in behavior.