Cookies were set with secure flag based solely on NODE_ENV, causing
401 errors when accessing over HTTP with NODE_ENV=production.
- Add COOKIE_SECURE env var for explicit control
- Auto-detect HTTPS via X-Forwarded-Proto header in production
- Extract isSecureCookie() utility to lib/auth/utils.ts
- Document COOKIE_SECURE in README and .env.example
Fixes#39
- Upgrade @lexical/* packages from 0.38.2 to 0.39.0
- Upgrade drizzle-orm from 0.44.7 to 0.45.1
- Upgrade react and react-dom from 19.2.0 to 19.2.3
- Upgrade sharp from 0.33.5 to 0.34.5
- Sync eslint-config-next with next@16.1.1
