Fix login issue when accessing via IP address over HTTP. Previously, the cookie secure flag was set based on NODE_ENV which caused cookies to not be sent when accessing via HTTP in production mode. Now it uses the actual request protocol (checking x-forwarded-proto header or request URL). Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>