Fix: Session cookie secure=false for HTTP support

In production with HTTP, secure cookies are rejected by browsers.
Allow HTTP until behind proper HTTPS proxy.

server/index.js

@@ -61,7 +61,7 @@ app.use(session({
   resave: false,
   saveUninitialized: false,
   cookie: {
-    secure: process.env.NODE_ENV === 'production',
+    secure: false, // Allow HTTP (set to true only behind HTTPS proxy)
     maxAge: CONFIG.sessionMaxAge
   }
 }));