One rule decides `Secure` on every cookie the forge sets: the visitor cookie on an app host is Secure over https #6095

On https://lab--forge-trevato-apps.open-platform.sh, GET /__forge/notes sets forge_visitor=…; Path=/; HttpOnly; SameSite=Lax; Max-Age=31536000 with no Secure. src/apps/proxy.ts decides it from url.protocol or x-forwarded-proto only. The session cookie (src/web/pages/site.ts) also trusts the forge's own https address, and src/web/flash.ts looks only at url.protocol.

Done when:

• [ ] src/http/cookie_secure.ts (or one function in an existing cookie module) answers secureFor(url, forgeUrl, appUrl?). It returns true when the request is https, the forge's own address is https, or the app's public address is https.
• [ ] The visitor cookie (src/apps/feedback.ts via proxy.ts), the flash cookies (src/web/flash.ts) and the session cookie (site.ts) all use it.
• [ ] A test sends an http request to a forge configured as https://… and asserts ; Secure on the visitor, flash and session cookies, then the reverse for a plain-http forge. Each assertion fails on main for the visitor and flash cookies.