feat(gpg): raise agent cache TTLs and make them overridable

Idle cache 30 min -> 1 h, absolute cap 2 h -> 8 h. Both `lib.mkDefault` so an
inventory can set `services.gpg-agent.defaultCacheTtl` without `mkForce`.

modules/gpg.nix

@@ -2,7 +2,7 @@
 # signing identity — those are personal (→ inventory). Enabling this alone is
 # harmless: a user with no key just has an idle agent.
 
-{ config, pkgs, ... }:
+{ config, lib, pkgs, ... }:
 
 {
   programs.gpg = {
@@ -26,7 +26,12 @@
     # sk-based ssh keys use the normal ssh-agent; don't let gpg-agent hijack
     # SSH_AUTH_SOCK.
     enableSshSupport = false;
-    defaultCacheTtl = 1800;   # 30 min
-    maxCacheTtl = 7200;       # 2 h
+    # Idle timer, reset on every use. The hard cap runs from the unlock and
+    # never resets, so a machine in continuous use still re-asks once a workday —
+    # otherwise an unattended unlocked session signs forever.
+    # mkDefault so an inventory can dial these per machine with a plain
+    # `services.gpg-agent.defaultCacheTtl = …;` and no mkForce.
+    defaultCacheTtl = lib.mkDefault 3600;   # 1 h idle
+    maxCacheTtl = lib.mkDefault 28800;      # 8 h absolute
   };
 }