fix: add cookie security attributes and error handling

- Add secure and sameSite attributes to cookie configuration
- Add try-catch block to handle malformed JSON and other errors
- Add validation for missing username or password fields

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

app/api/login/route.ts

@@ -3,21 +3,37 @@ import { NextResponse } from 'next/server';
 import { AUTH_USERNAME, AUTH_PASSWORD, COOKIE_NAME, COOKIE_MAX_AGE } from '@/lib/constants';
 
 export async function POST(request: Request) {
-  const body = await request.json();
-  const { username, password } = body;
+  try {
+    const body = await request.json();
+    const { username, password } = body;
 
-  if (username === AUTH_USERNAME && password === AUTH_PASSWORD) {
-    const response = NextResponse.json({ success: true });
-    response.cookies.set(COOKIE_NAME, 'ok', {
-      httpOnly: true,
-      maxAge: COOKIE_MAX_AGE,
-      path: '/',
-    });
-    return response;
+    if (!username || !password) {
+      return NextResponse.json(
+        { error: 'Username and password are required' },
+        { status: 400 }
+      );
+    }
+
+    if (username === AUTH_USERNAME && password === AUTH_PASSWORD) {
+      const response = NextResponse.json({ success: true });
+      response.cookies.set(COOKIE_NAME, 'ok', {
+        httpOnly: true,
+        secure: process.env.NODE_ENV === 'production',
+        sameSite: 'lax',
+        maxAge: COOKIE_MAX_AGE,
+        path: '/',
+      });
+      return response;
+    }
+
+    return NextResponse.json(
+      { error: 'Invalid credentials' },
+      { status: 401 }
+    );
+  } catch (error) {
+    return NextResponse.json(
+      { error: 'Invalid request' },
+      { status: 400 }
+    );
   }
-
-  return NextResponse.json(
-    { error: 'Invalid credentials' },
-    { status: 401 }
-  );
 }