feat(session): support opt-in Secure session cookies

- add SESSION_COOKIE_SECURE / SESSION_COOKIE_TRUSTED_URL env vars with
  startup validation: enabling Secure requires at least one trusted
  HTTPS entry URL
- wire common.SessionCookieSecure into the session cookie store instead
  of a hardcoded Secure=false
- print a startup warning when Secure session cookies are disabled
- document the new settings in .env.example and docker-compose files

Secure stays off by default because many deployments front new-api with
plain-HTTP reverse proxies, where a hardcoded Secure default would break
logins entirely; enabling it safely depends on the deployment's TLS
setup, so it ships as an opt-in deployment-hardening flag.

docker-compose.dev.yml

@@ -31,6 +31,9 @@ services:
       - REDIS_CONN_STRING=redis://redis
       - TZ=Asia/Shanghai
       - BATCH_UPDATE_ENABLED=true
+      # Enable only when accessing the dev backend through HTTPS. SESSION_COOKIE_TRUSTED_URL is required when true.
+      # - SESSION_COOKIE_SECURE=true
+      # - SESSION_COOKIE_TRUSTED_URL=https://example.com,https://admin.example.com
     depends_on:
       redis:
         condition: service_started