fix(login): link status ikut setting uptime_url + batas sesi per akun

- login.ejs: pakai settings.uptime_url (fallback status_url lama), sehingga tab Status tidak lagi hardcode status.skyfiber.qzz.io
- sessionLimitService: rotasi session id saat login (anti fixation), catat sesi di tabel login_sessions, batas admin/kasir/teknisi/kolektor 2 per akun dan pelanggan 3 per akun; sesi tertua diputus dari store saat melebihi batas
- hook login admin/kasir/teknisi/kolektor/pelanggan (direct & OTP) dan logout

routes/collectorPortal.js

@@ -6,6 +6,7 @@ const db = require('../config/database');
 const billingSvc = require('../services/billingService');
 const customerSvc = require('../services/customerService');
 const securityWatchdog = require('../services/securityWatchdogService');
+const sessionLimit = require('../services/sessionLimitService');
 const adminSvc = require('../services/adminService');
 const attendanceSvc = require('../services/attendanceService');
 const pdfSvc = require('../services/pdfInvoiceService');
@@ -65,7 +66,12 @@ router.post('/login', loginRateLimiter, express.urlencoded({ extended: true }),
   const collector = adminSvc.authenticateCollector(username, password);
   if (collector) {
     await securityWatchdog.recordAppLoginAttempt({ type: 'collector', username, ip, success: true });
+    await sessionLimit.rotateSession(req);
     req.session.isCollector = true;
+    sessionLimit.registerLoginSession(req, {
+      role: 'collector', accountId: collector.id, limit: 2,
+      ip, userAgent: req.get('user-agent')
+    });
     req.session.collectorId = collector.id;
     req.session.collectorName = collector.name;
     req.session.collectorUsername = collector.username;
@@ -83,6 +89,7 @@ router.post('/login', loginRateLimiter, express.urlencoded({ extended: true }),
 });
 
 router.get('/logout', (req, res) => {
+  sessionLimit.removeLoginSession(req);
   req.session.destroy();
   res.redirect('/collector/login');
 });