fix: stop Secure session cookies from breaking login on plain-HTTP deployments

[morcen]

What was broken

config/session.php defaulted the secure session-cookie flag to true whenever APP_ENV=production, regardless of whether the app was actually reachable over HTTPS. The repo's own shipped "production" paths never terminate TLS:

• docker-compose.yml's app/queue/scheduler services set APP_ENV=production, but the nginx service only listens on port 80 — no TLS anywhere in the stack.
• DEPLOYMENT.md's quick-start docker run --target production -p 80:9000 -e APP_ENV=production ... example exposes the app directly over plain HTTP.

Browsers silently discard Secure-flagged cookies sent over plain HTTP. So anyone following either of those documented paths would get a session cookie that never survives a request — login just appeared to do nothing, with no error surfaced anywhere. This was a functional regression introduced when secure was given a production-based default (previously it had no default at all, so this exact path worked).

What changed

• config/session.php: secure now defaults based on whether APP_URL is served over https://, instead of on APP_ENV. This reflects the actual public-facing transport rather than the deployment environment's name, so it self-corrects for every current and future deployment recipe without needing per-example patches. SESSION_SECURE_COOKIE still works as an explicit override in either direction.
• DEPLOYMENT.md: added a short note next to the affected quick-start example explaining the new default and telling operators to set APP_URL=https://your-domain.com once TLS is actually terminated in front of the app.
• tests/Unit/SessionSecureCookieConfigTest.php: updated/extended to cover the new APP_URL-based default, including a direct regression test for the APP_ENV=production + plain-HTTP APP_URL combination described above, a behind-TLS production case, and the explicit-override case.

Verification

• vendor/bin/pint --dirty — clean, no changes needed.
• composer test (full suite) — 208 passed, 7 skipped (pre-existing, unrelated skips), 0 failed.

Fixes #120