Make the session cookie unforgeable

[Allram]

Fixes #59.

The session cookie was a constant — any client that set M2MSESSIONID=1 was treated as logged in, bypassing the password entirely, including for the OTA upload endpoints.

This implements the approach suggested in the issue discussion: the cookie value is now MD5(client IP + login password), recomputed and verified on every request via is_authenticated(). Properties:

• The cookie can't be forged without knowing the password
• It can't be replayed from a different IP address
• Changing the login password invalidates all existing sessions
• No server-side session storage needed

Also while touching these lines:

• The cookie is now marked HttpOnly; SameSite=Strict
• Logout sets Max-Age=0 so the browser actually drops the cookie

MD5Builder comes from the Arduino core on both ESP8266 and ESP32, so no new dependencies. Clients on changing IPs (DHCP lease change) will need to log in again, which seems like the right trade-off for a device like this.

Testing

• pio test -e test-native passes; WEMOS_D1_Mini builds clean; src/ is clang-format-17 clean
• Flashed and tested on a WEMOS D1 Mini connected to a live Mitsubishi unit

🤖 Generated with Claude Code

[floatplane]

thank you for cleaning this up!