Secure: true requires HTTPS — cookie was not sent back on HTTP requests,
breaking the session after login.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Remove submodule tracking; backend is now a plain directory in the repo.
Also update deploy workflow: remove --recurse-submodules.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>