feat: flag session cookies Secure behind HTTPS proxies

[danielglh]

Delivers roadmap item 1 (see #4 for the plan).

Behavior

• The session cookie is flagged Secure automatically when a login arrives
  with X-Forwarded-Proto: https — the standard reverse-proxy setup. Logout's
  clearing cookie carries the same flag.
• Pin the behavior with OMP_WEB_SECURE_COOKIE=true|false (config.json key
  secureCookie also works) for setups where forwarded headers cannot be
  trusted. Default stays auto; plain HTTP keeps working as before.

Resolution order

loadConfig override → env → config file → "auto".

Tests

• auto mode: login through a forwarded-https request yields …; Secure, plain
  request does not; logout clear-cookie mirrors it
• overrides: secureCookie: true forces Secure without any header;
  secureCookie: false ignores the header
• resolution precedence: config file value read and beaten by env
• existing auth suite unchanged and green

Docs: README auth bullet rewritten, env table gains
OMP_WEB_SECURE_COOKIE, roadmap item checked off.