fix: session cookie over plain http, console onboarding gate, webkit qa coverage

- the session cookie was Secure whenever NODE_ENV=production, so a production build on http://localhost got no cookie back in Safari: every page after signup looked signed-out. It is now Secure only when X-Forwarded-Proto says https, or when COOKIE_SECURE=1.
- /app and /app/[id] now require an analyst and a Jev key, the same rule /api/analyze enforces with a 412. Closing the guide mid-way used to leave a console that could not run anything.
- Playwright runs the production server (pree2e builds first) and gains a webkit project for session survival; chromium-only QA could never see a Secure-cookie rejection.
- tests-e2e/session.spec.ts pins both; .env.example gains COOKIE_SECURE and stops shipping a blank APP_SECRET.
- e2e: 21 passed (setup, chromium, webkit, mobile).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

playwright.config.ts

@@ -18,11 +18,19 @@ export default defineConfig({
   use: { baseURL: "http://localhost:3000", trace: "retain-on-failure" },
   projects: [
     { name: "setup", testMatch: /auth\.setup\.ts/ },
-    { name: "chromium", use: { ...devices["Desktop Chrome"] }, dependencies: ["setup"] },
+    // The expensive specs are chromium-only (each real run costs ~30s of model time) and reuse the
+    // session the setup project wrote.
+    { name: "chromium", use: { ...devices["Desktop Chrome"] }, dependencies: ["setup"],
+      testIgnore: /session\.spec\.ts/ },
+    // Safari/WebKit only checks session survival: it is the one engine that refuses a Secure cookie on
+    // http://localhost, which is exactly how the wizard "signed itself out" in a production build.
+    { name: "webkit", use: { ...devices["Desktop Safari"] }, testMatch: /session\.spec\.ts/ },
     // A real model run costs ~40s; the mobile project only needs the layout checks, not a second full run.
     { name: "mobile", use: { ...devices["Pixel 7"] }, dependencies: ["setup"], testMatch: /responsive\.spec\.ts/ },
   ],
-  webServer: { command: "npm run dev", url: "http://localhost:3000/api/healthz", reuseExistingServer: true,
+  webServer: { // Run the production server: the cookie flags and hydration behaviour differ from dev, and that
+// difference hid a sign-out bug from a dev-only suite. `npm run pree2e` builds before this boots.
+command: "npm run start", url: "http://localhost:3000/api/healthz", reuseExistingServer: false,
     timeout: 120_000,
     env: { DATA_DIR: ".playwright-data", APP_SECRET: process.env.APP_SECRET ?? "playwright-secret-value" } },
 });