fix(web): recognise secure auth session cookies

[simonjcarr]

Summary

• make the Next proxy recognise Better Auth secure session cookie variants
• move session cookie-name handling into a tested helper
• add focused coverage for unprefixed, __Secure-, and __Host- session cookies

Root cause

In HTTPS production-like runs, Better Auth can set a secure-prefixed session cookie such as __Secure-better-auth.session_token. The login page asks Better Auth directly and treats that cookie as authenticated, redirecting /login to /dashboard. The Next proxy only checked better-auth.session_token, so it treated /dashboard as unauthenticated and redirected back to /login, causing a browser redirect loop.

Validation

• node --experimental-strip-types --test lib/auth/session-cookie-names.test.mjs
• npm run lint -- proxy.ts lib/auth/session-cookie-names.ts lib/auth/session-cookie-names.test.mjs
• npm run type-check
• Docker production build of ct-ops-web-local
• Browser verification with @browser-use: http://localhost:3000/dashboard loads Overview | CT-Ops after sign-in