Add SESSION_COOKIE_SECURE for HTTPS sessions

backend/__init__.py

@@ -38,6 +38,7 @@ def create_app(config_override: dict | None = None) -> Flask:
     app.config["SQLALCHEMY_TRACK_MODIFICATIONS"] = False
     app.config["SESSION_COOKIE_HTTPONLY"]    = True
     app.config["SESSION_COOKIE_SAMESITE"]    = "Lax"
+    app.config["SESSION_COOKIE_SECURE"]      = True
 
     if config_override:
         app.config.update(config_override)