feat(auth): explain the plain-HTTP secure-cookie gotcha on login

When the server issues a Secure session cookie but the request arrived over
plain HTTP (the common LAN install over http://ip:3000), the browser drops
the cookie and the next request dead-ends on a bare "Access token required" —
the top source of avoidable install issues. The login response now flags this
exact case and the login page shows a localized box explaining the fix (use
HTTPS, or set COOKIE_SECURE=false) with a link to the Troubleshooting guide.
It only triggers in the real failure case, never for correct HTTPS setups.

server/src/nest/auth/auth-public.controller.ts

@@ -4,6 +4,7 @@ import { AuthService } from './auth.service';
 import { RateLimitService } from './rate-limit.service';
 import { OptionalJwtGuard } from './optional-jwt.guard';
 import { writeAudit, getClientIp } from '../../services/auditLog';
+import { willDropSecureCookie } from '../../services/cookie';
 import type { User } from '../../types';
 
 const WINDOW = 15 * 60 * 1000;
@@ -88,7 +89,13 @@ export class AuthPublicController {
       return { mfa_required: true, mfa_token: result.mfa_token };
     }
     this.auth.setAuthCookie(res, result.token!, req, result.remember);
-    return { token: result.token, user: result.user };
+    return {
+      token: result.token,
+      user: result.user,
+      // Surfaced so the client can explain the plain-HTTP cookie gotcha instead
+      // of the user hitting a bare "Access token required" on the next request.
+      ...(willDropSecureCookie(req) ? { insecureCookie: true } : {}),
+    };
   }
 
   @Post('forgot-password')