fix(httpapi): align cluster selection cookie Secure flag with proxied HTTPS and add regression test

[Copilot]

Summary

• What changed:
  • Updated cluster selection cookie issuance in handleSelectCluster to use requestIsSecure(r) instead of direct r.TLS != nil.
  • Added a regression test (TestClusterSelectionCookieSecureWithForwardedProto) to assert Secure=true when X-Forwarded-Proto: https is present.
  • Backend change set
    • Cookie security decision path: now consistent with existing auth cookie logic.
    • Test coverage: explicitly covers TLS-terminating reverse-proxy traffic.
  • Example:

    // before
    Secure: r.TLS != nil,
    
    // after
    Secure: requestIsSecure(r),

• Why it changed:
  • The draft PR was blocked by failing checks; the cluster-selection cookie path still used stricter TLS-only detection and diverged from the existing secure-request helper used elsewhere.
• Risk level:
  • Low. Scoped to cluster-selection cookie attributes plus one focused regression test.

Validation

• npm run lint
• npm run test:go
• npm run test:web
• npm run test:e2e
• npm run test:predictor
• npm run verify:release
• npm run verify:changelog
• npm run verify:api-contract
• npm run verify:docs
• npm run verify:doc-impact
• npm run build

Security and operations impact

• Auth/RBAC behavior changed (cluster-selection cookie Secure now correctly follows proxied HTTPS via X-Forwarded-Proto)
• Terminal policy changed (explain)
• Audit schema/behavior changed (explain)
• Kubernetes manifests changed (explain)
• Documentation updated for behavior/configuration changes (explain)
• Implementation program status/scope updated when roadmap epics changed (explain)

Rollout and rollback

• Rollout steps:
  • Merge and deploy normally; no config/data migration required.
• Rollback steps:
  • Revert commit f8069d8 to restore prior cookie Secure behavior.