Stop describing dev as the default environment

Comments in reqtls and session, and the README Quick Start and
deployment checklist, still spoke as if an unset WEBHOOKER_ENVIRONMENT
meant dev. The checklist now asks only that the environment is not dev
(unset or prod); the Quick Start describes running from the clone.

Model: opus-5-5

internal/session/session.go

@@ -146,8 +146,8 @@ func newStore(key []byte) *sessions.CookieStore {
 //
 // This is decided per-request, not once at startup. Deciding it at
 // startup from the configured environment is what this replaces, and
-// it got the DEFAULT posture wrong: "dev" is the environment when
-// WEBHOOKER_ENVIRONMENT is unset, so a deployment terminating TLS at a
+// it got the DEFAULT posture wrong: "dev" was then the environment when
+// WEBHOOKER_ENVIRONMENT was unset, so a deployment terminating TLS at a
 // proxy without also setting the environment emitted the
 // authentication cookie with no Secure attribute -- silently, and on
 // the same response as a CSRF cookie that did have one.