fix: set cookie secure flag based on request protocol

Fix login issue when accessing via IP address over HTTP. Previously,
the cookie secure flag was set based on NODE_ENV which caused
cookies to not be sent when accessing via HTTP in production mode.
Now it uses the actual request protocol (checking x-forwarded-proto
header or request URL).

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

app/api/login/route.ts

@@ -16,9 +16,10 @@ export async function POST(request: Request) {
 
     if (username === AUTH_USERNAME && password === AUTH_PASSWORD) {
       const response = NextResponse.json({ success: true });
+      const isHttps = request.headers.get('x-forwarded-proto') === 'https' || request.url.startsWith('https:');
       response.cookies.set(COOKIE_NAME, 'ok', {
         httpOnly: true,
-        secure: process.env.NODE_ENV === 'production',
+        secure: isHttps,
         sameSite: 'lax',
         maxAge: COOKIE_MAX_AGE,
         path: '/',