Enhance authentication handling with secure cookie management

- Added support for configurable cookie security modes in the authentication logic, allowing for flexible handling of secure cookies based on the request scheme.
- Updated session management to respect the secure cookie flag based on the environment and request context.
- Modified the Fastify server setup to honor reverse proxy headers for improved cookie security in various deployment scenarios.
- Enhanced documentation in the codebase to clarify the new cookie security options and their implications.

docker-compose.yml

@@ -15,6 +15,11 @@ services:
       # AUTH_PASSWORD: change-me
       # SESSION_SECRET: long-random-string-at-least-32-chars
       # SESSION_TTL_HOURS: "168"
+      # Cookie Secure: auto (default) follows http/https per request — use for WireGuard IP + public HTTPS.
+      # COOKIE_SECURE: auto
+      # Force: always | never (or true | false)
+      # Behind a TLS-terminating reverse proxy, keep TRUST_PROXY on so X-Forwarded-Proto is honored.
+      # TRUST_PROXY: "true"
     volumes:
       - ./data:/app/data
     restart: unless-stopped