fix: a shell opens without the password and code again while the user's last use of a shell is within web.shell_auth_timeout minutes.

README.md

@@ -130,6 +130,7 @@ must have the type shown below; an unknown section or setting is an error.
 | `web` | `status_content` | string | `basic` | What `/` and `/status` show: `basic`, `standard` or `full` (see Status web service) |
 | `web` | `shell` | boolean | `false` | `/shell` opens a login shell for a member of `admins` with console login (see The shell) |
 | `web` | `shell_idle_minutes` | integer | `15` | Minutes without a keystroke after which a shell is closed, 1 to 1440 |
+| `web` | `shell_auth_timeout` | integer | `15` | Minutes after the last use of a shell in which a new shell opens without signing in again, 0 (always sign in) to 1440 |
 | `ssh` | `ldap_login` | boolean | `false` | sshd accepts the directory password of the console accounts in the directory (see Console login and SSH) |
 | `https` | `enabled` | boolean | `true` | Caddy serves the status web service and the Router Manager over HTTPS for `wan.local_fqdn` |
 | `https` | `email` | string | | The e-mail address of the Let's Encrypt account |
@@ -980,12 +981,14 @@ vpn-config-edit set web.shell true
 
 | Request | Body | Answer |
 | --- | --- | --- |
-| `POST /shell` | `{"password", "code"}`; `code` only for a user enrolled for TOTP | `{"ticket", "expires_in": 30}` |
+| `POST /shell` | `{"password", "code"}`; `code` only for a user enrolled for TOTP; `{}` within `web.shell_auth_timeout` | `{"ticket", "expires_in": 30}` |
 | `GET /shell?ticket=<ticket>` | a WebSocket handshake | the terminal |
 
 `POST /shell` needs an access token of `/auth`, not one of `vpn-router-token`, and signs its user
 in again: a wrong password or code gets 403 and counts as a failed login; it gets 403 too while
-`web.shell` is `false` or the user's console login is off. The ticket opens one
+`web.shell` is `false` or the user's console login is off. Without a password it gives a ticket
+while the user's last sign-in of `POST /shell` or keystroke in a shell is less than
+`web.shell_auth_timeout` minutes ago, and `{"ticket": null}` otherwise. The ticket opens one
 shell for the same user within 30 seconds. Over the WebSocket, binary messages of the client
 are keystrokes, a text message `{"cols", "rows"}` sets the window size, and binary messages of
 the router are the terminal's output. The shell is a PAM login session of the console account,