fix: decouple session cookie 'secure' flag from NODE_ENV

Cookie was silently never set because NODE_ENV=production forced
secure=true while the app is served over plain HTTP on the LAN (TLS
terminates at a reverse proxy later, not here). Add explicit
COOKIE_SECURE env var, default false.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.env.example

@@ -16,6 +16,11 @@ ADMIN_PASSWORD=
 # local | oidc (oidc not implemented yet, see issue #12)
 AUTH_MODE=local
 
+# Set to true only once a TLS-terminating reverse proxy sits in front (see
+# issue #13). Leave false for plain-HTTP LAN access, otherwise the session
+# cookie won't be set at all.
+COOKIE_SECURE=false
+
 PORT=3000
 POLL_INTERVAL_SECONDS=30
 SNAPSHOT_RETENTION_HOURS=24