fix(P01): SessionMiddleware kwargs — https_only/same_site (not secure/samesite)

Starlette SessionMiddleware uses `https_only` (not `secure`), `same_site`
(not `samesite`), and has no `httponly` kwarg (httponly is always true for
session cookies). The previous kwargs raised TypeError at middleware stack
build time. Cookie semantics are unchanged: https_only=secure flag,
same_site=strict, max_age=28800 (8h), session_cookie=praxis_op.

---ci---
project: praxis
phase: 1
milestone: v0.4
status: execute
persona: security-engineer
task: 03-02-fix
requirements:
  covered: [REQ-AUTH-01, REQ-NFR-AUTH-01]
---/ci---

server/auth/cookies.py

@@ -59,9 +59,8 @@ def get_session_middleware_kwargs() -> dict:
         "secret_key": secret,
         "session_cookie": "praxis_op",
         "max_age": _COOKIE_MAX_AGE_S,
-        "httponly": True,
-        "samesite": "strict",
-        "secure": secure,
+        "https_only": secure,
+        "same_site": "strict",
         "path": "/",
     }