fix: set Secure flag on session cookie in production mode (closes #5)

internal/service/auth/auth.go

@@ -73,6 +73,7 @@ func New(_ fx.Lifecycle, params ServiceParams) (*Service, error) {
 		Path:     "/",
 		MaxAge:   sessionMaxAgeSeconds,
 		HttpOnly: true,
+		Secure:   !params.Config.Debug,
 		SameSite: http.SameSiteLaxMode,
 	}