Add ALLOW_INSECURE_COOKIES env flag for HTTP access in production

Browsers drop Secure cookies on plain-http origins, so logging into the
admin over a LAN/VPN IP (e.g. during server migration, before TLS is in
front) silently failed every authenticated request. Setting
ALLOW_INSECURE_COOKIES=true omits the Secure flag; default behavior in
production is unchanged.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

server/study-helpers.js

@@ -1,6 +1,6 @@
 import { createHash, randomUUID } from 'node:crypto'
 import path from 'node:path'
-import { parseCookies } from './helpers.js'
+import { parseCookies, cookieSecureFlag } from './helpers.js'
 import {
   STUDY_SESSION_COOKIE,
   STUDY_SESSION_TTL_MS,
@@ -131,7 +131,7 @@ export function getStudyAvatarUrl(subject) {
 // ── Session management ─────────────────────────────────────────────────────
 
 export function cookieFlags() {
-  return process.env.NODE_ENV === 'production' ? '; Secure' : ''
+  return cookieSecureFlag()
 }
 
 export function createStudySession(userId) {