fix: mint dashboard session cookies

[avocet-bot]

Summary

Mints random in-memory dashboard session IDs for the cp_dash cookie instead of storing the dashboard_secret directly in the browser. Header-based X-Clawpatrol-Secret auth is preserved for scripted/admin callers.

Changes

• Add in-memory dashboard session storage with expiry and dashboard_secret-rotation invalidation
• Set cp_dash to a random 32-byte session token on successful login
• Mark the dashboard cookie Secure when the request is HTTPS or X-Forwarded-Proto is https
• Add regression coverage for non-secret cookie values, session auth, arbitrary cookie rejection, header auth, and HTTPS proxy Secure behavior

Testing

• git diff --check HEAD~1..HEAD
• Not run: go test ./... (go/gofmt are not installed in this subagent environment)

Fixes #311