fix: session_expired after login on HTTP deployments (#241)

Three changes to fix the immediate-logout issue reported by multiple
Docker users:

1. Add explicit `credentials: 'same-origin'` to the login fetch call.
   This was the only fetch in the entire codebase missing it. While
   modern browsers default to 'same-origin', some privacy configs or
   older engines may default to 'omit', silently dropping Set-Cookie
   headers from the login response.

2. Post-login cookie verification: after a successful login, the
   frontend now checks that the CSRF cookie (non-HttpOnly, readable
   by JS) was actually stored before redirecting. If the browser
   rejected the cookies, a clear error message is shown explaining
   the OXICLOUD_COOKIE_SECURE / HTTP mismatch.

3. Server-side diagnostic: the login handler now warns in logs when
   Secure cookies are set on a request that didn't arrive via HTTPS
   (no X-Forwarded-Proto: https header), pointing admins to the
   OXICLOUD_COOKIE_SECURE=false fix.

Root cause: users who set OXICLOUD_BASE_URL=https://... (or have
OXICLOUD_COOKIE_SECURE=true) but access via plain HTTP get cookies
with the Secure flag, which browsers silently reject over HTTP.

src/interfaces/api/cookie_auth.rs

@@ -34,6 +34,10 @@ pub const CSRF_HEADER: &str = "x-csrf-token";
 /// 4. **Default: `false`** for compatibility with HTTP deployments
 ///    (Docker, local development). Set `OXICLOUD_COOKIE_SECURE=true`
 ///    explicitly for production HTTPS environments.
+pub fn is_cookie_secure() -> bool {
+    cookie_secure()
+}
+
 fn cookie_secure() -> bool {
     if let Ok(v) = std::env::var("OXICLOUD_COOKIE_SECURE") {
         let secure = v == "true" || v == "1";