fix: persistent sessiebeheer (remember-me), HTTPS-cookie herstel en Microsoft OAuth signed state flow

auth/login.php

@@ -12,8 +12,9 @@ if (!has_admin_user()) {
     exit;
 }
 
-// Als al volledig ingelogd en 2FA geverifieerd, ga naar planner
-if (!empty($_SESSION['user_id']) && !empty($_SESSION['is_2fa_verified'])) {
+// Als al ingelogd (via actieve sessie of persistente cookie), ga direct naar planner
+$currentUser = get_logged_in_user();
+if ($currentUser) {
     header('Location: /planner.php');
     exit;
 }
@@ -96,6 +97,9 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
                 $_SESSION['user_role'] = $user['role'];
                 $_SESSION['is_2fa_verified'] = true;
 
+                // Activeer persistente remember token (30 dagen blijf ingelogd)
+                issue_remember_token((int)$user['id']);
+
                 unset($_SESSION['pending_2fa_user_id'], $_SESSION['pending_2fa_user_email'], $_SESSION['pending_2fa_user_name']);
 
                 header('Location: /planner.php');