0a951029fd
Starlette SessionMiddleware uses `https_only` (not `secure`), `same_site` (not `samesite`), and has no `httponly` kwarg (httponly is always true for session cookies). The previous kwargs raised TypeError at middleware stack build time. Cookie semantics are unchanged: https_only=secure flag, same_site=strict, max_age=28800 (8h), session_cookie=praxis_op. ---ci--- project: praxis phase: 1 milestone: v0.4 status: execute persona: security-engineer task: 03-02-fix requirements: covered: [REQ-AUTH-01, REQ-NFR-AUTH-01] ---/ci---