🍪 feat: Configurable Secure Cookie Behavior

[XHyperDEVX]

Summary

This pull request introduces a configurable environment variable, SESSION_COOKIE_SECURE environment .env.example to allow explicit control over whether the session cookie is sent only over HTTPS. By default, this is true in production and false otherwise.

• Updated src/server/session.ts to use the new SESSION_COOKIE_SECURE variable for the session cookie's secure attribute, instead of relying solely on the NODE_ENV value. [1] [2]

Change Type

• New feature (non-breaking change which adds functionality)

Testing

• Confirm toggling of new environment variable behaves as expected in all possible combinations of configurations

Checklist

• My code adheres to this project's style guidelines
• I have performed a self-review of my own code
• Local unit tests pass with my changes

[CLAassistant]

All committers have signed the CLA.