fix: derive auth cookie Secure flag from request protocol

[ruanbarroso]

Problem

Auth and session cookies were hardcoded as Secure in production:

secure: process.env.NODE_ENV === 'production'
// login route: FORCE_HTTPS || (production && DISABLE_SECURE_COOKIE !== 'true')

Browsers discard Secure cookies over plain HTTP (except on localhost). So on any HTTP IP:port deployment (e.g. http://10.1.0.190:8081), POST /api/auth/login succeeds server-side and returns the cookie, but the browser drops it — the user is bounced straight back to the login screen and can never stay authenticated. Same for the redis-explorer-session cookie in middleware, which would also break server-side Redis sessions over HTTP.

Fix

New helper src/lib/auth-cookie.ts derives the Secure flag from the actual request protocol instead of hardcoding it:

• default → Secure over HTTPS (incl. behind a TLS-terminating proxy via x-forwarded-proto), and not Secure over plain HTTP, so login works on internal IP:port access without weakening HTTPS deployments.
• FORCE_HTTPS=true → always Secure.
• DISABLE_SECURE_COOKIE=true → never Secure (explicit escape hatch).

Applied consistently to all cookie sites:

• src/app/api/auth/login/route.ts
• src/app/api/auth/logout/route.ts (now takes request to match flags on clear)
• src/app/api/auth/setup/route.ts
• src/middleware.ts (session cookie)

.env.example documents the two override vars.

Tests

• New __tests__/auth-cookie.test.ts covering isSecureRequest, shouldUseSecureCookie (protocol default + both env overrides + precedence), and authCookieOptions.
• Full suite: 12/12 passing. next build ✓, tsc --noEmit clean on all changed files.

🤖 Generated with Claude Code