Forward fresh-login requirements to the authentication provider

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c

src/internal/adapters/authelia/adapter.go

@@ -8,6 +8,7 @@ import (
 	"io"
 	"net/http"
 	"net/url"
+	"strconv"
 	"strings"
 	"time"
 
@@ -54,6 +55,12 @@ func (a *AutheliaAdapter) AuthorizeURL(_ context.Context, req domain.AuthRequest
 	q.Set("response_type", "code")
 	q.Set("state", req.State)
 	q.Set("scope", "openid profile email groups")
+	if req.PromptLogin {
+		q.Set("prompt", "login")
+	}
+	if req.MaxAge != nil {
+		q.Set("max_age", strconv.FormatInt(int64(req.MaxAge.Seconds()), 10))
+	}
 
 	return base + "?" + q.Encode(), nil
 }