fix(#1136): replace localStorage with HMAC-signed session cookie (no process memory)

[ionfwsrijan]

Problem

The API key was stored in localStorage under secuscan_api_key, making it accessible to any XSS attack.

Solution

Replaced localStorage with HMAC-signed session cookies — no server-side session store needed.

Key differences from previous attempt (PR #1172)

1. No process-memory session store — cookies are self-contained HMAC-signed tokens. Survives server restarts, works across multiple processes, no external dependencies.
2. Conditional Secure flag — only set when request is over HTTPS or carries X-Forwarded-Proto: https. HTTP localhost development works without breaking.
3. No formatting churn in main.py — exactly 2 lines changed (import + router registration).
4. No new dependencies — uses stdlib , hmac, hashlib, base64, json

Closes #1136

[ionfwsrijan]

@utksh1 Please review this now