Use cookie.secure='auto' so login works over HTTP too

Cookie was unconditionally Secure in production, which made the
browser drop it whenever the app was accessed over plain HTTP
(e.g. http://host:3000) — login appeared to succeed but the cookie
never came back. 'auto' delegates the decision to express-session
based on req.secure, so the same build works for both direct HTTP
access and HTTPS-via-proxy setups.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server.js

@@ -89,7 +89,11 @@ app.use(session({
     cookie: {
         httpOnly: true,
         sameSite: 'lax',
-        secure: isProd,
+        // 'auto' = secure cookie when req.secure is true (HTTPS or trust-proxy
+        // detected HTTPS), plaintext cookie when accessed over HTTP. Lets the
+        // same build serve both http://host:3000 and https://host/ without a
+        // login loop.
+        secure: 'auto',
         maxAge: 1000 * 60 * 60 * 24 * 7, // 7 days
     },
 }));