fix(P01): SessionMiddleware kwargs — https_only/same_site (not secure/samesite)

Starlette SessionMiddleware uses `https_only` (not `secure`), `same_site`
(not `samesite`), and has no `httponly` kwarg (httponly is always true for
session cookies). The previous kwargs raised TypeError at middleware stack
build time. Cookie semantics are unchanged: https_only=secure flag,
same_site=strict, max_age=28800 (8h), session_cookie=praxis_op.

---ci---
project: praxis
phase: 1
milestone: v0.4
status: execute
persona: security-engineer
task: 03-02-fix
requirements:
  covered: [REQ-AUTH-01, REQ-NFR-AUTH-01]
---/ci---

tests/test_auth.py

@@ -68,9 +68,10 @@ def test_cookie_kwargs_defaults(monkeypatch):
     kw = get_session_middleware_kwargs()
     assert kw["session_cookie"] == "praxis_op"
     assert kw["max_age"] == 28800
-    assert kw["httponly"] is True
-    assert kw["samesite"] == "strict"
-    assert kw["secure"] is True
+    # Starlette SessionMiddleware: https_only (not secure), same_site (not samesite),
+    # httponly is always True (no kwarg). path is the cookie path.
+    assert kw["https_only"] is True
+    assert kw["same_site"] == "strict"
     assert kw["path"] == "/"
 
 
@@ -78,7 +79,7 @@ def test_cookie_secure_false(monkeypatch):
     monkeypatch.setenv("PRAXIS_COOKIE_SECRET", "x" * 48)
     monkeypatch.setenv("PRAXIS_COOKIE_SECURE", "false")
     kw = get_session_middleware_kwargs()
-    assert kw["secure"] is False
+    assert kw["https_only"] is False
 
 
 def test_cookie_secret_unset_generates_random(monkeypatch):