QA용 보안 쿠키 설정을 분리한다

운영에서는 Secure 쿠키를 강제한다.`nHTTP로 실행하는 격리 QA에서만 환경 변수로 해제할 수 있게 했다.

backend/routers/library.py

@@ -3,6 +3,7 @@ from __future__ import annotations
 import hashlib
 import hmac
 import json
+import os
 import re
 import secrets
 from pathlib import Path
@@ -261,12 +262,13 @@ def login(payload: AuthPayload, response: Response):
 
 
 def _set_cookie(response: Response, token: str) -> None:
+    secure_cookie = os.environ.get("SESSION_COOKIE_SECURE", "1").strip().lower() not in {"0", "false", "no"}
     response.set_cookie(
         COOKIE_NAME,
         token,
         max_age=30 * 24 * 60 * 60,
         httponly=True,
-        secure=True,
+        secure=secure_cookie,
         samesite="lax",
         path="/",
     )

docker-compose.yml

@@ -31,6 +31,7 @@ services:
       - BOOTSTRAP_ADMIN_USERNAME=syskiller
       - BOOTSTRAP_ADMIN_DISPLAY_NAME=관리자
       - BOOTSTRAP_ADMIN_PASSWORD_FILE=/run/secrets/library_admin_password
+      - SESSION_COOKIE_SECURE=1
     volumes:
       # Mount audiveris.jar from host (optional - PDF import is disabled if absent)
       - ./backend/bin:/app/bin:ro