master
feat(p08): Phase 0 + Phase 1 mock-first UI with agent-driven review
fix: make Secure cookie flag explicit via COOKIE_SECURE env var