fix: force secure cookie on HF Spaces

src/routes/dashboard-login.ts

@@ -45,6 +45,8 @@ function recordFailure(ip: string): void {
 
 /** Detect HTTPS from X-Forwarded-Proto (reverse proxy) or protocol. */
 function isHttps(c: Context): boolean {
+  // HF Spaces always uses HTTPS
+  if (process.env.HF_SPACE_ID || process.env.SPACES) return true;
   const proto = c.req.header("x-forwarded-proto");
   if (proto) return proto.toLowerCase() === "https";
   const url = new URL(c.req.url);