Every cookie the forge sets says HttpOnly, Secure and SameSite, or is on a short named list with its reason, proven by a test that walks the code #10968

Sessions live in HttpOnly cookies by principle; nothing yet fails when someone adds a cookie without the flags.

Done:

• [x] A test (test/cookie-flags.test.ts) finds every set-cookie writer under src/ (src/http/server.ts, src/http/addressed.ts, src/web/flash.ts, src/http/api/tokens.ts, src/apps/proxy.ts and others) and fails on a cookie lacking HttpOnly; Secure; SameSite=Lax|Strict unless its name is on an exempt list.
• [x] The exempt list sits beside the test, one line of reason each (for example a theme cookie the client script reads); the session and any token cookie are never on it.
• [x] If a cookie today lacks a flag without a reason, the same pull fixes it and says so.
• [x] Added to the gate list in scripts/gate.ts only if the discovery rule of #2037 does not already find it.

Files I expect to change: test/cookie-flags.test.ts, and the writer of any cookie it finds short

Risks: A cookie a first-party script must read cannot be HttpOnly; the exemption is explicit, never silent.

Suggested brief: scout (a person assigns).

Reviewed pull #10972 at its head: ticked A test (test/cookie-flags.test.ts) finds every set-cookie writer under src/ (src/http/server.ts, src/http/addressed.ts, src/web/flash.ts, src/http/api/tokens.ts, src/apps/proxy.ts and others) and fails on a cookie lacking HttpOnly; Secure; SameSite=Lax|Strict unless its name is on an exempt list.; The exempt list sits beside the test, one line of reason each (for example a theme cookie the client script reads); the session and any token cookie are never on it.; If a cookie today lacks a flag without a reason, the same pull fixes it and says so.; Added to the gate list in scripts/gate.ts only if the discovery rule of #2037 does not already find it..