SAMPLE EVIDENCE for AU-03 (made-up app Tidyhaus; not a real review)

Token iat to exp: 3600 seconds. Supabase session settings (owner's screenshot described): inactivity timeout 7 days; time-box 30 days.