[VULN-20] Missing Secure Cookie Flag

[lyncmi07]

Severity: Medium
Affected locations: routes/auth.ts:43,68,77

Issue:
Session cookie lacks Secure, so it may be sent over plaintext HTTP in insecure deployments.

Mitigation plan:

1. Add Secure to all session cookies.
2. Ensure production is HTTPS-only.
3. Document local-dev behavior (optional dev override).

Verification / tests:

• Tests assert Set-Cookie includes HttpOnly; SameSite=Strict; Secure in production mode.