fix(auth): set the session cookie's Secure flag behind a TLS-terminating proxy (M462 #4977)

The cookie set Secure from r.TLS, which is nil whenever TLS terminates at
Traefik or Cloudflare, so a public deployment's session cookie went out
without Secure. auth.IsHTTPS now decides it from X-Forwarded-Proto, believed
only through the trusted-hop count (rule 94) and read positionally like
X-Forwarded-For. Plain-HTTP and LAN logins are unchanged; nothing redirects.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/auth/clientip_test.go

@@ -1,6 +1,7 @@
 package auth
 
 import (
+	"crypto/tls"
 	"net/http"
 	"testing"
 )
@@ -168,3 +169,45 @@ func TestClientIP(t *testing.T) {
 		})
 	}
 }
+
+func TestIsHTTPS(t *testing.T) {
+	tests := []struct {
+		name  string
+		hops  int
+		proto string
+		tls   bool
+		want  bool
+	}{
+		// The three cases rule 94 names.
+		{name: "hops 0 ignores a forwarded https", hops: 0, proto: "https", want: false},
+		{name: "hops 1 believes a forwarded https", hops: 1, proto: "https", want: true},
+		{name: "plain request is not https", hops: 1, want: false},
+
+		{name: "forwarded http is not https", hops: 1, proto: "http", want: false},
+		{name: "case-insensitive", hops: 1, proto: "HTTPS", want: true},
+		{name: "direct TLS is https whatever the hops", hops: 0, tls: true, want: true},
+		// An appending chain is read positionally: with one trusted hop the
+		// last entry is our proxy's word, and a client-supplied first entry
+		// cannot flip it.
+		{name: "appended chain reads our proxy's entry", hops: 1, proto: "https, http", want: false},
+		{name: "two hops read the CDN's entry", hops: 2, proto: "https, http", want: true},
+		{name: "over-counted hops clamp to the first entry", hops: 5, proto: "https", want: true},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			r, err := http.NewRequest(http.MethodGet, "/api/auth/login", nil)
+			if err != nil {
+				t.Fatalf("NewRequest: %v", err)
+			}
+			if tc.proto != "" {
+				r.Header.Set("X-Forwarded-Proto", tc.proto)
+			}
+			if tc.tls {
+				r.TLS = &tls.ConnectionState{}
+			}
+			if got := IsHTTPS(r, tc.hops); got != tc.want {
+				t.Errorf("IsHTTPS(hops=%d, proto=%q) = %v, want %v", tc.hops, tc.proto, got, tc.want)
+			}
+		})
+	}
+}