feat(config): SESSION_COOKIE_SECURE leggibile dall'ambiente (#38.4)

config.py: default invariato (sicuro salvo FLASK_DEBUG=1); nuova env
SESSION_COOKIE_SECURE=false la spegne esplicitamente, per l'installazione
on-premise dove nginx serve HTTP in LAN - un cookie Secure su origine non
HTTPS viene scartato dal browser in silenzio e il login non regge mai.
.env.example documenta la variabile (commentata, comportamento invariato
di default). docker-compose e default dev restano al lotto C2.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/frontend/flask_app/config.py

@@ -23,7 +23,18 @@ class Config:
     # Session
     SESSION_COOKIE_HTTPONLY = True
     SESSION_COOKIE_SAMESITE = "Lax"
-    SESSION_COOKIE_SECURE = not DEBUG  # Only secure cookies in production (HTTPS)
+    # Default: secure unless FLASK_DEBUG=1 (unchanged). Explicit override via
+    # SESSION_COOKIE_SECURE=false for the on-premise install (#38.4): nginx
+    # there listens on plain HTTP inside the LAN, and a cookie marked Secure
+    # is silently dropped by the browser on a non-HTTPS origin - login looks
+    # like it works and the session never sticks.
+    _session_cookie_secure_env = os.getenv("SESSION_COOKIE_SECURE")
+    if _session_cookie_secure_env is not None:
+        SESSION_COOKIE_SECURE = _session_cookie_secure_env.strip().lower() not in (
+            "false", "0", "no",
+        )
+    else:
+        SESSION_COOKIE_SECURE = not DEBUG
     PERMANENT_SESSION_LIFETIME = 28800  # 8 hours
     # None = token valid for the life of the session (#12): a measurement page
     # stays open for hours between saves, and a 1h-expired token turned every