feat: replace gorilla/sessions with alexedwards/scs/v2

Browser sessions are now server-side, stored in the SQLite database via
scs/sqlite3store (new `sessions` table, DB migration to version 12) instead
of gorilla/sessions client-side cookie storage. Only an opaque random token
is kept in the cookie; session data lives server-side and survives restarts.

Session middleware is wired as a hybrid to avoid buffering large responses:
scs.LoadAndSave on the login/logout write paths, and a non-buffering
read-only LoadSession middleware on the secured/config/frontend read paths
so the large GraphQL /query responses stream unbuffered. JWT-only APIs
(/api, /userapi, /api/metricstore) and static files are left unwrapped.

The session cookie Secure flag is now derived from the server config (set
when cc-backend terminates TLS itself); previously it was effectively never
set. The SESSION_KEY env var is removed as server-side tokens need no
signing secret. The dormant Bearer-JWT branch in the frontend urql client
is removed; the web UI authenticates GraphQL via the session cookie.

Closes #558

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Entire-Checkpoint: b51075f43cc7

web/frontend/src/generic/utils.js

@@ -4,7 +4,7 @@ import {
     setContextClient,
     fetchExchange,
 } from "@urql/svelte";
-import { setContext, getContext, hasContext, onDestroy, tick } from "svelte";
+import { setContext, getContext, onDestroy, tick } from "svelte";
 import { readable } from "svelte/store";
 import { round } from "mathjs";
 
@@ -21,14 +21,11 @@ import { round } from "mathjs";
  * - Adds 'getHardwareTopology' to the context, a function that takes a cluster nad subCluster and returns the subCluster topology (or undefined)
  */
 export function init(extraInitQuery = "") {
-    const jwt = hasContext("jwt")
-        ? getContext("jwt")
-        : getContext("cc-config")["jwt"];
-
+    // The web UI authenticates GraphQL requests via the session cookie
+    // (same-origin), so no Authorization header is attached here. External
+    // clients use a JWT against /query directly.
     const client = new Client({
         url: `${window.location.origin}/query`,
-        fetchOptions:
-            jwt != null ? { headers: { Authorization: `Bearer ${jwt}` } } : {},
         exchanges: [
             expiringCacheExchange({
                 ttl: 5 * 60 * 1000,