fix: add COOKIE_SECURE environment variable to control cookie security

Allows cookies to work over HTTP even in production mode by setting
COOKIE_SECURE=false. This is needed for local Docker deployments that
use HTTP instead of HTTPS.

When COOKIE_SECURE=false, the secure flag is disabled on cookies.
When COOKIE_SECURE is not set or set to any other value, it defaults
to the production mode behavior (secure cookies in production).

backend/app.js

@@ -85,7 +85,7 @@ const sessionMiddleware = session({
     saveUninitialized: false,
     cookie: {
         httpOnly: true,
-        secure: config.production,
+        secure: process.env.COOKIE_SECURE !== 'false' && config.production,
         maxAge: 2592000000, // 30 days
         sameSite: 'lax',
     },