feat: enhance session management by adding secure cookie handling based on HTTPS detection

frontend/app/api/auth/login/route.ts

@@ -86,6 +86,13 @@ export async function POST(request: Request) {
   }
 
   clearAttempts(ip)
-  await createSession({ userId: user.id, username: user.username, role: user.role })
+
+  // Detect whether the client is on HTTPS (via reverse-proxy header or direct TLS).
+  // CasaOS and most self-hosted setups run over plain HTTP, so the cookie must
+  // NOT be marked Secure or the browser will silently drop it.
+  const proto = request.headers.get('x-forwarded-proto') ?? ''
+  const isHttps = proto.split(',')[0].trim() === 'https'
+
+  await createSession({ userId: user.id, username: user.username, role: user.role }, isHttps)
   return NextResponse.json({ ok: true, username: user.username, role: user.role })
 }