fix(auth): resolve cookie authentication failure over HTTP

Cookies were set with secure flag based solely on NODE_ENV, causing
401 errors when accessing over HTTP with NODE_ENV=production.

- Add COOKIE_SECURE env var for explicit control
- Auto-detect HTTPS via X-Forwarded-Proto header in production
- Extract isSecureCookie() utility to lib/auth/utils.ts
- Document COOKIE_SECURE in README and .env.example

Fixes #39

README.md

@@ -102,6 +102,11 @@ PGID=1000
 # Optional - JWT Secret (auto-generated if not provided)
 # Generate with: openssl rand -base64 32
 SECRET=
+
+# Optional - Cookie Security
+# Set to 'false' for HTTP access (e.g., local LAN without HTTPS)
+# When unset, auto-detects HTTPS via X-Forwarded-Proto header
+COOKIE_SECURE=false
 ```
 
 ### User Permissions (PUID/PGID)