feat(auth): configure Spring Session JDBC (fa_session, 8h idle, SameSite=strict)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/src/main/resources/application-dev.yaml

@@ -1,6 +1,11 @@
 spring:
   jpa:
     show-sql: true
+  session:
+    cookie:
+      # Dev runs over HTTP (port 5173 → 8080); Secure=true would prevent the
+      # cookie from being sent on plain HTTP. Override to false for local dev only.
+      secure: false
 
 springdoc:
   api-docs: