fix(auth): set token cookies Secure only over HTTPS

[nossila]

Summary

Login on a production build served over plain HTTP never kept the user signed in. Stacked on #1 (merge/baseapp-files), the branch whatplant pins.

• Cause: useLogin and refreshAccessToken set the access and refresh token cookies with secure: process.env.NODE_ENV === 'production'. On a next start build served over http:// (a LAN test server or a staging host without TLS), browsers drop Secure cookies set from HTTP pages, except on localhost.
• Result: the token request succeeded, but no Authorization / Refresh cookie was stored, so /v1/users/me answered 401 Authentication credentials were not provided.
• Fix: new shouldUseSecureCookies() in @baseapp-frontend/utils.
  • In the browser it follows window.location.protocol.
  • Elsewhere (SSR, native) it keeps the NODE_ENV rule.
  • useLogin and refreshAccessToken use it.
  • HTTPS deployments keep Secure cookies.
• Changeset: patch for @baseapp-frontend/utils and @baseapp-frontend/authentication.
• Projects that set token cookies in their own middleware.ts with the same NODE_ENV rule should switch to the request's scheme (X-Forwarded-Proto behind a proxy). The whatplant frontend does this in its own PR.

Worth upstreaming to silverlogic/baseapp-frontend: the bug is in the template's defaults.

Test plan

• vitest: functions/token 29 passed (new shouldUseSecureCookies tests), useLogin 3 passed.
• On a whatplant production build served at http://10.244.99.39:3001:
  • before: after login only Language and CurrentProfile cookies exist;
  • after: Authorization and Refresh are stored, and the account menu and signed-in navigation show.

🤖 Generated with Claude Code

https://claude.ai/code/session_019P1oyApi4BLS8iLfMEGm8b