fix: set Secure/HttpOnly/SameSite on session cookies (closes #47) (#48)

closes #47

Fixes the two remaining `gosec` findings on `main`, both `G124`
(http.Cookie missing or has insecure `Secure`, `HttpOnly`, or
`SameSite` attribute):

- `internal/session/session.go:84` (`CreateSession`, the login
  set-cookie path)
- `internal/session/session.go:128` (`ClearSession`, the logout
  delete-cookie path)

## What changed

- Both cookie-writing paths now unconditionally set `Secure: true`,
  `HttpOnly: true`, and `SameSite: http.SameSiteStrictMode`.
- The `secure` field (previously wired to `!config.Debug`) and the
  `sameSite` field are removed from `session.Manager`, and the dead
  secure-toggle parameter is removed from `session.NewManager`, which
  now takes only the signing key (reviewer-directed; the mechanical
  call-shape updates in `session_test.go` leave every assertion
  untouched).
- TDD per repo rules: the first commit adds
  `TestSessionCookieAttributesAlwaysSecure` (failing), asserting that
  every cookie emitted by the session manager carries `HttpOnly`,
  `Secure`, and `SameSite` of Lax or stricter, for both write paths.
  The second commit makes it pass.
- `TODO.md` updated per its Workflow section (Next Step completed,
  next Future Step promoted, stale "10 open findings" Status text
  corrected).

## Attribute choices and reasoning

- `Secure: true` always: the `G124` analyzer only accepts a constant
  `true` store, and there is no legitimate configuration in which the
  authentication cookie should be sent over plaintext HTTP. The old
  behavior disabled `Secure` whenever `debug` was on. Local development
  over `http://localhost` keeps working: browsers treat `localhost` as
  a trustworthy origin and accept `Secure` cookies there. Any
  plain-HTTP flow on a non-localhost host will no longer keep a
  session, which is the point of the fix.
- `SameSite: Strict` (unchanged from current production behavior, and
  stricter than the Lax minimum): the login form is a same-origin POST
  to `/` followed by a same-site redirect, so `Strict` breaks nothing.
- `HttpOnly: true` (unchanged).

## Verification

`make check` (tests, golangci-lint, fmt-check) is fully green on the
branch head `cb9e14e`: all tests pass and the linter reports 0 issues,
independently confirmed by the reviewer in a fresh worktree. Commit
history: `ca15f52` (failing test) → `02ca16a` (fix + TODO.md, closes
#47) → `cb9e14e` (drop the dead `NewManager` parameter).

Co-authored-by: sneak <sneak@sneak.berlin>
Reviewed-on: #48
Co-authored-by: clawbot <clawbot@noreply.example.org>
Co-committed-by: clawbot <clawbot@noreply.example.org>

internal/session/session_test.go

@@ -8,7 +8,7 @@ import (
 )
 
 func TestManager_CreateAndValidate(t *testing.T) {
-	mgr, err := NewManager("test-signing-key-12345", false)
+	mgr, err := NewManager("test-signing-key-12345")
 	if err != nil {
 		t.Fatalf("NewManager() error = %v", err)
 	}
@@ -57,7 +57,7 @@ func TestManager_CreateAndValidate(t *testing.T) {
 }
 
 func TestManager_ValidateSession_NoCookie(t *testing.T) {
-	mgr, _ := NewManager("test-signing-key-12345", false)
+	mgr, _ := NewManager("test-signing-key-12345")
 
 	req := httptest.NewRequest(http.MethodGet, "/", nil)
 
@@ -72,7 +72,7 @@ func TestManager_ValidateSession_NoCookie(t *testing.T) {
 }
 
 func TestManager_ValidateSession_TamperedCookie(t *testing.T) {
-	mgr, _ := NewManager("test-signing-key-12345", false)
+	mgr, _ := NewManager("test-signing-key-12345")
 
 	req := httptest.NewRequest(http.MethodGet, "/", nil)
 	req.AddCookie(&http.Cookie{
@@ -91,8 +91,8 @@ func TestManager_ValidateSession_TamperedCookie(t *testing.T) {
 }
 
 func TestManager_ValidateSession_WrongKey(t *testing.T) {
-	mgr1, _ := NewManager("signing-key-1", false)
-	mgr2, _ := NewManager("signing-key-2", false)
+	mgr1, _ := NewManager("signing-key-1")
+	mgr2, _ := NewManager("signing-key-2")
 
 	// Create session with mgr1
 	w := httptest.NewRecorder()
@@ -118,7 +118,7 @@ func TestManager_ValidateSession_WrongKey(t *testing.T) {
 }
 
 func TestManager_ClearSession(t *testing.T) {
-	mgr, _ := NewManager("test-signing-key-12345", false)
+	mgr, _ := NewManager("test-signing-key-12345")
 
 	w := httptest.NewRecorder()
 	mgr.ClearSession(w)
@@ -144,7 +144,7 @@ func TestManager_ClearSession(t *testing.T) {
 }
 
 func TestManager_IsAuthenticated(t *testing.T) {
-	mgr, _ := NewManager("test-signing-key-12345", false)
+	mgr, _ := NewManager("test-signing-key-12345")
 
 	// No session - should return false
 	req := httptest.NewRequest(http.MethodGet, "/", nil)
@@ -175,8 +175,7 @@ func TestManager_IsAuthenticated(t *testing.T) {
 }
 
 func TestManager_CookieAttributes(t *testing.T) {
-	// Test with secure=true
-	mgr, _ := NewManager("test-key", true)
+	mgr, _ := NewManager("test-key")
 
 	w := httptest.NewRecorder()
 	_ = mgr.CreateSession(w)