Honor forwarded HTTPS for session cookies

[aiirvizionz]

Summary

• Detect the public HTTPS scheme from x-forwarded-proto, nextUrl, or request URL before falling back to deploy env.
• Pass the active request into native login/signup and CoinPay callback session cookie creation.
• Keeps session cookies Secure behind TLS terminators such as Cloudflare, Vercel, Railway, or nginx even when the app process receives HTTP internally.

Validation

• .\node_modules.bin\tsc.CMD --noEmit
• git diff --check