master
fix: make Secure cookie flag explicit via COOKIE_SECURE env var
fix: switch DB client to Neon WebSocket driver for VPS deployment
feat(p08): Phase 0 + Phase 1 mock-first UI with agent-driven review