feat(session): support opt-in Secure session cookies

- add SESSION_COOKIE_SECURE / SESSION_COOKIE_TRUSTED_URL env vars with
  startup validation: enabling Secure requires at least one trusted
  HTTPS entry URL
- wire common.SessionCookieSecure into the session cookie store instead
  of a hardcoded Secure=false
- print a startup warning when Secure session cookies are disabled
- document the new settings in .env.example and docker-compose files

Secure stays off by default because many deployments front new-api with
plain-HTTP reverse proxies, where a hardcoded Secure default would break
logins entirely; enabling it safely depends on the deployment's TLS
setup, so it ships as an opt-in deployment-hardening flag.

.env.example

@@ -69,6 +69,9 @@
 
 # 会话密钥
 # SESSION_SECRET=random_string
+# 启用 Secure session cookie，必须同时配置可信 HTTPS 入口地址；多个地址用英文逗号分隔
+# SESSION_COOKIE_SECURE=false
+# SESSION_COOKIE_TRUSTED_URL=https://example.com,https://admin.example.com
 
 # 其他配置
 # 生成默认token