fix(auth): preserve Plex sessions on HTTP

[snapetech]

Description

Restore transport-aware session cookies so Plex sign-in works on direct HTTP/LAN deployments while HTTPS deployments continue to receive Secure cookies. The login page now verifies /auth/me after the Plex exchange and clears the spinner with an actionable error when the browser session was not established.

The root cause was an unconditional secure: true override at the session sink. The browser rejected that cookie on kspls0:5055, so the UI never observed an authenticated user. The maintainer decision record explicitly says not to reintroduce that setting until HTTP is removed behind a verified HTTPS migration.

How Has This Been Tested?

• Focused Plex/auth and session-cookie tests passed.
• Server and client TypeScript checks passed.
• Prettier and ESLint passed.
• The production image built successfully.
• Live kspls0 verification passed over direct HTTP and HTTPS: Plex exchange returned 200, the expected cookie attributes were emitted, and /auth/me returned user 1.

Screenshots / Logs (if applicable)

Live verification confirmed the direct HTTP cookie is not Secure, the HTTPS cookie is Secure, and both authenticated sessions returned user 1.

Release Notes

• I added a release-note fragment under release-notes/.
• This change is internal-only and does not need a user-facing release note.
• The fragment includes audience, area, action, and breaking-change status.
• I previewed the release text with pnpm release-notes:preview.

Checklist:

• I have read and followed the contribution guidelines.
• Disclosed any use of AI (see our policy)
• I have updated the documentation accordingly.
• All new and existing tests passed.
• Successful build pnpm build
• Translation keys pnpm i18n:extract
• Database migration (if required)

[github-actions]

Hey @snapetech, thanks for submitting this PR! However, it looks like the PR template hasn't been fully filled out.

Issues found:

• Release Notes must select exactly one of the two release-note options.

---

Please update your PR description to follow the PR template.
Incomplete or missing PR descriptions may indicate insufficient review of the changes, and PRs that do not follow the template may be closed without review.
See our Contributing Guide for more details.

This check will automatically re-run when you edit your PR description.

[snapetech]

Closing this draft; the owner requested a direct push to main instead of a pull request.