fix(auth): remove hardcoded fallback session cookie signing secret

[mukktinaadh]

Fixes #1446.

Problem

AUTH_COOKIE_SECRET fell back to a committed literal:

_DEV_AUTH_COOKIE_SECRET = "your_cookie_signing_secret"
AUTH_COOKIE_SECRET = os.getenv("AUTH_COOKIE_SECRET", _DEV_AUTH_COOKIE_SECRET)

That value signs the session cookie JWT (_encode_session_cookie) and verifies it
(_decode_session_cookie). Any deployment running without the variable set therefore
accepted session cookies signed with a key that is public in the source tree.

Verification

Against the parent commit, a cookie forged with the committed literal and naming a
session that exists decoded to that valid Session:

active signing secret == committed literal? True
VULNERABLE: forged cookie accepted as -> True

After the change, the same cookie raises AuthException, and a cookie signed with the
configured secret still round-trips.

Changes

• AUTH_COOKIE_SECRET is read from the environment with no default.
• When unset, an ephemeral per-process secret is generated with secrets.token_hex(32)
  and a warning is logged. Local development keeps working with no committed signing
  key; cookies signed with the ephemeral value are dropped on restart and are not valid
  across replicas, which the warning states explicitly.
• The now-dead "unsafe AUTH_COOKIE_SECRET" check is removed.

This is fail-safe rather than fail-closed: a missing variable in production now means
sessions do not survive a restart, instead of a silently known signing key. If you would
rather the process refuse to start when the variable is missing, that is a small change
on top and I am happy to switch it.

Tests

New app/api/tests/auth/test_session_cookie.py, 6 tests:

• a cookie signed with the old committed literal is rejected
• ...and is still rejected when it names a session that exists
• encode/decode round-trip returns the same session
• an unknown session returns None
• the cookie payload carries only session_id
• the active secret is never the committed literal

ruff check and ruff format --check pass on both files.

One caveat on execution: tests/_conftest/clickhouse.py defines a session-scoped
autouse fixture that builds the ClickHouse image via Docker, and Docker is unavailable
in my environment. I verified the behaviour each test asserts directly against the module
(see Verification above) and confirmed all six are collected, but I have not executed the
file under pytest locally. CI should be able to, since is_github_actions() skips the
Docker build.