fix: session cookie secure flag was never true-to-request

cookie.secure was tied to NODE_ENV=production instead of whether the
request actually arrived over HTTPS, so in a production build the
admin login cookie was never stored at all when accessed over plain
HTTP (e.g. direct container access, or a proxy that doesn't terminate
TLS in front of the admin panel) — confirmed while deploying to
production, login returned 200 but no session persisted. "auto" uses
req.secure via the existing trust-proxy setting instead.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/server/src/index.ts

@@ -22,7 +22,12 @@ app.use(
     saveUninitialized: false,
     cookie: {
       httpOnly: true,
-      secure: process.env.NODE_ENV === "production",
+      // "auto": secure only if the request actually arrived over HTTPS (checks req.secure,
+      // which respects "trust proxy" + X-Forwarded-Proto). A flat `NODE_ENV === "production"`
+      // check meant the cookie was never stored at all when the admin panel is reached over
+      // plain HTTP (e.g. direct to the container, or behind a proxy that doesn't terminate TLS
+      // for it) — login would silently "succeed" but no session would ever persist.
+      secure: "auto",
       maxAge: 1000 * 60 * 60 * 12,
     },
   }),