fix(auth): correct local cookie security configuration

validation-suite/frontend/atlas/tests/auth-cookie.test.mjs

@@ -0,0 +1,42 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+function parseCookieSecure(value) {
+  return value?.trim().toLowerCase() === "true";
+}
+
+test("AUTH_COOKIE_SECURE=false yields secure false", async () => {
+  assert.equal(parseCookieSecure("false"), false);
+  const options = {
+    httpOnly: true,
+    secure: parseCookieSecure("false"),
+    sameSite: "lax",
+    path: "/",
+    maxAge: 3600
+  };
+  assert.deepEqual(options, {
+    httpOnly: true,
+    secure: false,
+    sameSite: "lax",
+    path: "/",
+    maxAge: 3600
+  });
+});
+
+test("AUTH_COOKIE_SECURE=true yields secure true", async () => {
+  assert.equal(parseCookieSecure("true"), true);
+  const options = {
+    httpOnly: true,
+    secure: parseCookieSecure("true"),
+    sameSite: "lax",
+    path: "/",
+    maxAge: 0
+  };
+  assert.deepEqual(options, {
+    httpOnly: true,
+    secure: true,
+    sameSite: "lax",
+    path: "/",
+    maxAge: 0
+  });
+});