SUM-SEC-19 [P2][19/20][Low] Harden session cookie attributes

[CHINMAYVIVEK]

ID: SUM-SEC-19
Wave: P2
Severity: Low
Labels: security, cookies, P2, low
Branch: fix/SUM-SEC-19-session-cookie-hardening
Languages: Go

Summary

Session cookie is HttpOnly + SameSite=Lax (good). Residual hardening: __Host- prefix, optional SameSite=Strict where UX allows, explicit Secure policy from SUM-SEC-15.

Acceptance criteria

• Document / optionally enable __Host-sumeru_session when HTTPS + path /
• Evaluate Strict for session vs Lax for login UX; implement if product accepts
• No regression on login/logout cookie clear

Files to check / change

• sumeru/core/server/web/auth_session.go (buildSessionCookie)