fix(auth): allow disabling Secure cookie flag via COOKIE_SECURE=false
Dev cluster serves plain HTTP behind an IP; browsers silently drop Secure cookies, so the session never persisted after login. Deployment sets COOKIE_SECURE=false until Traefik terminates TLS.