fix: session cookie over plain http, console onboarding gate, webkit qa coverage

- the session cookie was Secure whenever NODE_ENV=production, so a production build on http://localhost got no cookie back in Safari: every page after signup looked signed-out. It is now Secure only when X-Forwarded-Proto says https, or when COOKIE_SECURE=1.
- /app and /app/[id] now require an analyst and a Jev key, the same rule /api/analyze enforces with a 412. Closing the guide mid-way used to leave a console that could not run anything.
- Playwright runs the production server (pree2e builds first) and gains a webkit project for session survival; chromium-only QA could never see a Secure-cookie rejection.
- tests-e2e/session.spec.ts pins both; .env.example gains COOKIE_SECURE and stops shipping a blank APP_SECRET.
- e2e: 21 passed (setup, chromium, webkit, mobile).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.env.example

@@ -1,2 +1,10 @@
-APP_SECRET=
-DATA_DIR=/data
+# At least 16 characters. Encrypts the model keys you paste in /settings (AES-256-GCM).
+# Changing it makes already-stored keys unreadable — you will have to paste them again.
+APP_SECRET=replace-with-32-random-characters
+
+# Where qai.db lives. Default ./data; the Docker image sets /data.
+DATA_DIR=./data
+
+# Only for a direct https deploy with no proxy setting X-Forwarded-Proto.
+# Leave unset on plain http: Safari will not store a Secure cookie there.
+# COOKIE_SECURE=1