Fix session cookie: disable Secure flag for HTTP deployment

Secure: true requires HTTPS — cookie was not sent back on HTTP requests,
breaking the session after login.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/internal/api/webui.go

@@ -106,7 +106,7 @@ func (ui *WebUI) HandlePostLogin(w http.ResponseWriter, r *http.Request) {
 		Value:    sess.SessionID,
 		Path:     "/",
 		HttpOnly: true,
-		Secure:   true,
+		Secure:   false,
 		SameSite: http.SameSiteLaxMode,
 		Expires:  sess.ExpiresAt,
 	})