Keep neoirc-cli sessions on localhost and test the relay goroutine stop

The auth cookie is always Secure, and Go 1.24's cookie jar sends a
Secure cookie only over HTTPS, so neoirc-cli lost its session against a
plain-HTTP server on localhost. Its jar now treats a server on localhost
as HTTPS, as curl does. The README's Transport Security section and
Python example say what a client needs.

A test checks that closing a registered IRC client's connection stops
its relay goroutine. The README Entrypoints section names a make target
only for the scripts that have one, and the Dockerfile says why the
test phase runs with -p 4.

Model: opus-5-5

Dockerfile

@@ -24,8 +24,6 @@ RUN golangci-lint run --config .golangci.yml ./...
 
 # Test phase, built alone by script/test. -race needs cgo and so a C
 # compiler, which the Debian Go image ships and the alpine one does not.
-# -p 4 runs at most four test binaries at once: under -race each one
-# costs a few hundred MB, and the default is one per core.
 # golang:1.24.13-bookworm, 2026-10-06
 FROM golang@sha256:1a6d4452c65dea36aac2e2d606b01b4a029ec90cc1ae53890540ce6173ea77ac AS test
 WORKDIR /src
@@ -33,6 +31,7 @@ COPY go.mod go.sum ./
 RUN go mod download
 COPY . .
 RUN mkdir -p web/dist && touch web/dist/index.html web/dist/style.css web/dist/app.js
+# -p 4 because test runs on a shared build host cap their parallelism.
 RUN go test -p 4 -timeout 90s -race -cover ./... || \
     { echo "--- Rerunning with -v for details ---"; \
       go test -p 4 -timeout 90s -race -v ./...; exit 1; }