api-gateway CSRF cookie lacks Secure flag in non-prod HTTPS

[therealjhay]

ProblembuildCsrfCookieHeader sets Secure only when NODE_ENV === 'production'; a staging HTTPS environment in NODE_ENV=development serves the CSRF cookie without Secure.

1. Secure flag tied to NODE_ENV, not actual TLS.
2. Staging HTTPS insecure cookie.
3. Cookie policy drift.

Solution

• Set Secure when the request is HTTPS regardless of env.
• Centralize cookie attribute logic.
• Test both transports.

Acceptance Criteria

• HTTPS always gets Secure cookies.
• HTTP dev still works.
• pnpm --filter api-gateway build passes.

Note for Contributors: Write a clear PR description. Show the transport-aware cookie test.