Add ALLOW_INSECURE_COOKIES env flag for HTTP access in production

Browsers drop Secure cookies on plain-http origins, so logging into the
admin over a LAN/VPN IP (e.g. during server migration, before TLS is in
front) silently failed every authenticated request. Setting
ALLOW_INSECURE_COOKIES=true omits the Secure flag; default behavior in
production is unchanged.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

server/auth.js

@@ -1,7 +1,7 @@
 import { createHash, randomUUID, timingSafeEqual, createHmac, randomFillSync } from 'node:crypto'
 import { readFile, writeFile } from 'node:fs/promises'
 import path from 'node:path'
-import { parseCookies } from './helpers.js'
+import { parseCookies, cookieSecureFlag } from './helpers.js'
 import { DATA_DIR } from './paths.js'
 
 const TOTP_SECRET_FILE = path.join(DATA_DIR, 'totp-secret.json')
@@ -18,7 +18,7 @@ const ADMIN_PASSWORD = process.env.ADMIN_PASSWORD
 const adminSessions = new Map()
 
 function cookieFlags() {
-  return process.env.NODE_ENV === 'production' ? '; Secure' : ''
+  return cookieSecureFlag()
 }
 
 export function sha256(value) {