feat(session): support opt-in Secure session cookies

- add SESSION_COOKIE_SECURE / SESSION_COOKIE_TRUSTED_URL env vars with
  startup validation: enabling Secure requires at least one trusted
  HTTPS entry URL
- wire common.SessionCookieSecure into the session cookie store instead
  of a hardcoded Secure=false
- print a startup warning when Secure session cookies are disabled
- document the new settings in .env.example and docker-compose files

Secure stays off by default because many deployments front new-api with
plain-HTTP reverse proxies, where a hardcoded Secure default would break
logins entirely; enabling it safely depends on the deployment's TLS
setup, so it ships as an opt-in deployment-hardening flag.

common/sys_log.go

@@ -46,6 +46,13 @@ func LogStartupSuccess(startTime time.Time, port string) {
 	LogWriterMu.RLock()
 	defer LogWriterMu.RUnlock()
 
+	if SessionCookieSecure == false {
+		// log warning if session cookie is not secure
+		fmt.Fprintf(gin.DefaultWriter, "\n")
+		fmt.Fprintf(gin.DefaultWriter, "  \033[33mWarning: Session cookie is not secure. Please set SESSION_COOKIE_SECURE=true in production.\033[0m\n")
+		fmt.Fprintf(gin.DefaultWriter, "\n")
+	}
+
 	fmt.Fprintf(gin.DefaultWriter, "\n")
 	fmt.Fprintf(gin.DefaultWriter, "  \033[32m%s %s\033[0m  ready in %d ms\n", SystemName, Version, durationMs)
 	fmt.Fprintf(gin.DefaultWriter, "\n")