Every cookie the forge sets is HttpOnly and SameSite, and Secure on https: a test signs in by each door and reads every Set-Cookie #5898

Sessions belong in HttpOnly cookies. Cookies are set in several places today (src/http/server.ts, src/http/rp.ts, the app proxy's grant), and no one test reads them all.

Done when:

• [ ] A test walks every way the forge sets a cookie: passkey sign-in, parent sign-in (/signin/parent), sign-out, the mode switch, and an app host's /__forge/grant. It collects every Set-Cookie and checks HttpOnly and SameSite=Lax or Strict on each, and Secure when the public origin is https.
• [ ] A cookie-setting site the test cannot reach is listed by name with why, and the list is checked.
• [ ] Any cookie found missing a flag is fixed in the same pull.