fix: set Secure/HttpOnly/SameSite on session cookies (closes #47) (#48)

closes #47

Fixes the two remaining `gosec` findings on `main`, both `G124`
(http.Cookie missing or has insecure `Secure`, `HttpOnly`, or
`SameSite` attribute):

- `internal/session/session.go:84` (`CreateSession`, the login
  set-cookie path)
- `internal/session/session.go:128` (`ClearSession`, the logout
  delete-cookie path)

## What changed

- Both cookie-writing paths now unconditionally set `Secure: true`,
  `HttpOnly: true`, and `SameSite: http.SameSiteStrictMode`.
- The `secure` field (previously wired to `!config.Debug`) and the
  `sameSite` field are removed from `session.Manager`, and the dead
  secure-toggle parameter is removed from `session.NewManager`, which
  now takes only the signing key (reviewer-directed; the mechanical
  call-shape updates in `session_test.go` leave every assertion
  untouched).
- TDD per repo rules: the first commit adds
  `TestSessionCookieAttributesAlwaysSecure` (failing), asserting that
  every cookie emitted by the session manager carries `HttpOnly`,
  `Secure`, and `SameSite` of Lax or stricter, for both write paths.
  The second commit makes it pass.
- `TODO.md` updated per its Workflow section (Next Step completed,
  next Future Step promoted, stale "10 open findings" Status text
  corrected).

## Attribute choices and reasoning

- `Secure: true` always: the `G124` analyzer only accepts a constant
  `true` store, and there is no legitimate configuration in which the
  authentication cookie should be sent over plaintext HTTP. The old
  behavior disabled `Secure` whenever `debug` was on. Local development
  over `http://localhost` keeps working: browsers treat `localhost` as
  a trustworthy origin and accept `Secure` cookies there. Any
  plain-HTTP flow on a non-localhost host will no longer keep a
  session, which is the point of the fix.
- `SameSite: Strict` (unchanged from current production behavior, and
  stricter than the Lax minimum): the login form is a same-origin POST
  to `/` followed by a same-site redirect, so `Strict` breaks nothing.
- `HttpOnly: true` (unchanged).

## Verification

`make check` (tests, golangci-lint, fmt-check) is fully green on the
branch head `cb9e14e`: all tests pass and the linter reports 0 issues,
independently confirmed by the reviewer in a fresh worktree. Commit
history: `ca15f52` (failing test) → `02ca16a` (fix + TODO.md, closes
#47) → `cb9e14e` (drop the dead `NewManager` parameter).

Co-authored-by: sneak <sneak@sneak.berlin>
Reviewed-on: #48
Co-authored-by: clawbot <clawbot@noreply.example.org>
Co-committed-by: clawbot <clawbot@noreply.example.org>

TODO.md

@@ -10,22 +10,27 @@
 
 # Status
 
-pre-1.0. No git tags exist. main (6b4a1d7, 2026-04-07) is current with
-origin; recent work extracted the internal/magic and internal/allowlist
-packages. The 10 gosec findings from the 2026-07-06 morning survey are
-NOT fixed on main: the newest gosec/lint fix commits are from
-2026-02-25 (85729d9, ce6db76) and nothing since touches gosec, so those
-findings remain open.
+pre-1.0. No git tags exist. Recent work extracted the internal/magic,
+internal/allowlist, internal/httpfetcher, and internal/signature
+packages. The gosec findings from the 2026-07-06 survey are resolved:
+the last two open findings (G124, session cookie attributes in
+internal/session) are fixed as of this change, so `make check` is green
+on main.
 
 # Next Step
 
-Fix the 10 open gosec lint findings so make check passes on main again
-(main must always be green; no gosec fix commits have landed since
-2026-02-25). No blanket suppressions; fix or justify each finding
-individually.
+P0: manual test pass of the auth and encrypted URL flows, then commit
+the checked-off results to TODO.md: visit / and see the login form;
+wrong key shows an error; correct signing key shows the generator form;
+a generated encrypted URL serves the image; an expired URL (short TTL)
+returns 410; logout redirects back to login
 
 # Completed Steps
 
+- 2026-08-07 fix the two remaining gosec findings (G124 in
+  internal/session): session cookies now always carry
+  Secure/HttpOnly/SameSite=Strict on both the set and clear paths;
+  `make check` green (closes #47)
 - 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints,
   Makefile shims, README Entrypoints section
 - 2026-04-07 extract magic byte detection into internal/magic (#42)
@@ -48,11 +53,6 @@ individually.
 
 # Future Steps
 
-- P0: manual test pass of the auth and encrypted URL flows, then
-  commit the checked-off results to TODO.md: visit / and see the login
-  form; wrong key shows an error; correct signing key shows the
-  generator form; a generated encrypted URL serves the image; an
-  expired URL (short TTL) returns 410; logout redirects back to login
 - P0: implement cache size management and eviction so the disk cannot
   fill up
 - P0: validate configuration on startup, fail fast on bad config