feat(auth): add secure flag to JSESSIONID cookie and test JSESSIONID cookie setting

- Add secure: true to cookies.set() in login and signup actions
- Add tests verifying JSESSIONID is forwarded to browser on successful
  login and signup

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/src/routes/(public)/signup/+page.server.ts

@@ -43,7 +43,7 @@ export const actions = {
 
 		const sessionId = response.headers.get('set-cookie')?.match(/JSESSIONID=([^;]+)/i)?.[1];
 		if (sessionId) {
-			cookies.set('JSESSIONID', sessionId, { path: '/', httpOnly: true, sameSite: 'lax' });
+			cookies.set('JSESSIONID', sessionId, { path: '/', httpOnly: true, sameSite: 'lax', secure: true });
 		}
 
 		throw redirect(303, '/household/setup');