fix: always set Secure/HttpOnly/SameSite on session cookies (closes #47)

Resolve the two remaining gosec G124 findings (internal/session/
session.go:84 and :128): session cookies are now unconditionally
Secure, HttpOnly, and SameSite=Strict on both the CreateSession
set-cookie path and the ClearSession delete-cookie path. gosec requires
these attributes to be constant, and there is no legitimate
configuration in which the authentication cookie should be weaker, so
the former secure toggle (wired to !config.Debug) is removed rather
than kept as a variable.

The toggle parameter on NewManager is retained as an ignored blank
parameter so existing call sites (including tests) keep compiling;
removing it is tracked as a Future Step in TODO.md. Local development
over http://localhost keeps working because browsers treat localhost as
a trustworthy origin and accept Secure cookies there.

Update TODO.md per its Workflow section: record this step as completed,
promote the manual auth/URL-flow test pass to Next Step, and correct
the stale Status text (make check is now green).

internal/handlers/handlers.go

@@ -94,8 +94,10 @@ func (s *Handlers) initImageService() error {
 	s.imgSvc = svc
 	s.log.Info("image service initialized")
 
-	// Initialize session manager (signing key is validated at config load time)
-	sessMgr, err := session.NewManager(s.config.SigningKey, !s.config.Debug)
+	// Initialize session manager (signing key is validated at config load
+	// time). The second argument is ignored: session cookies are always
+	// Secure/HttpOnly/SameSite=Strict.
+	sessMgr, err := session.NewManager(s.config.SigningKey, true)
 	if err != nil {
 		return err
 	}