Harden authentication cookie Secure policy

[cdcavell]

Summary

• change the local authentication cookie default from CookieSecurePolicy.SameAsRequest to CookieSecurePolicy.Always
• add an explicit ProjectTemplate:Authentication:Cookie:AllowInsecureHttp override for local Development only
• reject the insecure HTTP override during startup validation in every non-Development environment, even when application authentication is currently disabled
• pass the host environment into authentication registration so the policy is resolved deliberately
• document the HTTPS requirement, reverse-proxy behavior, and local plain-HTTP development path

Tests

Added coverage for:

• secure cookies using CookieSecurePolicy.Always by default
• the explicit Development override using CookieSecurePolicy.SameAsRequest
• startup validation rejecting the override outside Development

Validation

GitHub Actions CI passed:

• solution build and analyzer validation
• dotnet format verification
• full test suite
• coverage generation and repository threshold enforcement
• security-critical coverage thresholds
• dependency review
• CodeQL analysis
• template smoke tests on Ubuntu, Windows, and macOS
• Docker build, Compose startup, and health verification
• non-default no-auth/SQL Server scaffold validation

Fixes #372