feat(config): SESSION_COOKIE_SECURE leggibile dall'ambiente (#38.4)

config.py: default invariato (sicuro salvo FLASK_DEBUG=1); nuova env
SESSION_COOKIE_SECURE=false la spegne esplicitamente, per l'installazione
on-premise dove nginx serve HTTP in LAN - un cookie Secure su origine non
HTTPS viene scartato dal browser in silenzio e il login non regge mai.
.env.example documenta la variabile (commentata, comportamento invariato
di default). docker-compose e default dev restano al lotto C2.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/frontend/flask_app/tests/test_config_session_cookie_secure.py

@@ -0,0 +1,50 @@
+"""SESSION_COOKIE_SECURE reads from the environment (#38.4).
+
+Default unchanged (secure unless FLASK_DEBUG=1); SESSION_COOKIE_SECURE=false
+overrides it for the on-premise HTTP-in-LAN install.
+"""
+import importlib
+
+
+def _reload_config():
+    import config
+    importlib.reload(config)
+    return config
+
+
+def test_defaults_secure_when_not_debug(monkeypatch):
+    monkeypatch.delenv("SESSION_COOKIE_SECURE", raising=False)
+    monkeypatch.delenv("FLASK_DEBUG", raising=False)
+    config = _reload_config()
+    assert config.Config.SESSION_COOKIE_SECURE is True
+
+
+def test_defaults_insecure_when_debug(monkeypatch):
+    monkeypatch.delenv("SESSION_COOKIE_SECURE", raising=False)
+    monkeypatch.setenv("FLASK_DEBUG", "1")
+    config = _reload_config()
+    assert config.Config.SESSION_COOKIE_SECURE is False
+
+
+def test_explicit_false_overrides_default_in_production(monkeypatch):
+    """On-premise over plain HTTP: FLASK_DEBUG stays unset (real prod), but
+    the cookie must not be marked Secure or the browser silently drops it."""
+    monkeypatch.delenv("FLASK_DEBUG", raising=False)
+    monkeypatch.setenv("SESSION_COOKIE_SECURE", "false")
+    config = _reload_config()
+    assert config.Config.SESSION_COOKIE_SECURE is False
+
+
+def test_explicit_true_keeps_secure(monkeypatch):
+    monkeypatch.setenv("FLASK_DEBUG", "1")
+    monkeypatch.setenv("SESSION_COOKIE_SECURE", "true")
+    config = _reload_config()
+    assert config.Config.SESSION_COOKIE_SECURE is True
+
+
+def test_falsy_values_are_case_insensitive(monkeypatch):
+    monkeypatch.delenv("FLASK_DEBUG", raising=False)
+    for value in ("false", "FALSE", "0", "no", "  False  "):
+        monkeypatch.setenv("SESSION_COOKIE_SECURE", value)
+        config = _reload_config()
+        assert config.Config.SESSION_COOKIE_SECURE is False, value