fix: session cookie over plain http, console onboarding gate, webkit qa coverage

- the session cookie was Secure whenever NODE_ENV=production, so a production build on http://localhost got no cookie back in Safari: every page after signup looked signed-out. It is now Secure only when X-Forwarded-Proto says https, or when COOKIE_SECURE=1.
- /app and /app/[id] now require an analyst and a Jev key, the same rule /api/analyze enforces with a 412. Closing the guide mid-way used to leave a console that could not run anything.
- Playwright runs the production server (pree2e builds first) and gains a webkit project for session survival; chromium-only QA could never see a Secure-cookie rejection.
- tests-e2e/session.spec.ts pins both; .env.example gains COOKIE_SECURE and stops shipping a blank APP_SECRET.
- e2e: 21 passed (setup, chromium, webkit, mobile).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

probe-tmp.mjs

@@ -0,0 +1,30 @@
+import { chromium } from "@playwright/test";
+
+const BASE = "http://127.0.0.1:3100";
+const b = await chromium.launch();
+const ctx = await b.newContext({ baseURL: BASE });
+const p = await ctx.newPage();
+const where = () => new URL(p.url()).pathname + new URL(p.url()).search;
+const h1 = async () => (await p.locator("h1").first().innerText().catch(() => "?"));
+
+const email = `qa${Date.now()}@test.dev`;
+await p.goto("/signup");
+await p.fill("#email", email);
+await p.fill("#password", "0123456789ab");
+await p.getByRole("button", { name: "Create account" }).click();
+await p.waitForURL(/setup|app|login/, { timeout: 20_000 });
+console.log("1 signup done   :", where(), "| h1:", await h1());
+
+await p.getByRole("link", { name: "Next" }).click();
+await p.waitForURL(/step=2/, { timeout: 20_000 });
+console.log("2 clicked Next  :", where(), "| h1:", await h1());
+
+await p.getByRole("link", { name: "Next" }).click();
+await p.waitForTimeout(2500);
+console.log("3 Next again    :", where(), "| h1:", await h1(), "| alert:", await p.getByRole("alert").count());
+
+// Is the session still alive after that?
+await p.goto("/app");
+await p.waitForTimeout(2000);
+console.log("4 open /app     :", where(), "| h1:", await h1());
+await b.close();