Initial commit of Descrybe v2 without local scratch artifacts.

Drop one-shot tmp/axe scripts and agent i18n scratch so the Gitea tree is deployable.

apps/api/internal/auth/session_test.go

@@ -0,0 +1,45 @@
+package auth
+
+import (
+	"net/http"
+	"testing"
+	"time"
+)
+
+func TestNewSessionManagerCookieFlags(t *testing.T) {
+	t.Parallel()
+
+	sm := NewSessionManager(nil, "descrybe_session", true, 12)
+	if sm.Cookie.Name != "descrybe_session" {
+		t.Fatalf("Name = %q", sm.Cookie.Name)
+	}
+	if !sm.Cookie.HttpOnly {
+		t.Fatal("session cookie must be HttpOnly")
+	}
+	if !sm.Cookie.Secure {
+		t.Fatal("secure=true must set Secure")
+	}
+	if sm.Cookie.SameSite != http.SameSiteLaxMode {
+		t.Fatalf("SameSite = %v, want Lax", sm.Cookie.SameSite)
+	}
+	if sm.Cookie.Path != "/" {
+		t.Fatalf("Path = %q, want /", sm.Cookie.Path)
+	}
+	if sm.IdleTimeout != 12*time.Hour {
+		t.Fatalf("IdleTimeout = %v, want 12h", sm.IdleTimeout)
+	}
+	if sm.Lifetime != 7*24*time.Hour {
+		t.Fatalf("Lifetime = %v, want 7d", sm.Lifetime)
+	}
+
+	insecure := NewSessionManager(nil, "descrybe_session", false, 0)
+	if insecure.Cookie.Secure {
+		t.Fatal("secure=false must not set Secure")
+	}
+	if !insecure.Cookie.HttpOnly {
+		t.Fatal("session cookie must remain HttpOnly")
+	}
+	if insecure.IdleTimeout != 24*time.Hour {
+		t.Fatalf("default IdleTimeout = %v, want 24h", insecure.IdleTimeout)
+	}
+}