- Extract session cookie issuance into sessionCookies.ts helper; remove
duplicated COOKIE_BASE blocks from login, register, oauth callback/authorize,
refresh handler, hooks.server.ts, and onboarding.
- Derive cookie secure flag from ORIGIN (https://...) instead of NODE_ENV so
plain-HTTP production deploys don't silently drop cookies.
- Auto-login admin after onboarding completes; UI does a full reload so
hooks.server.ts picks up the new session.
- Harden onboarding: reject duplicate admin creation, flip onboardingComplete
atomically to prevent concurrent completions, error out if no admin found.
- Fix Dockerfile CMD operator precedence: node build now always runs after
migrate deploy || db push.
- Wire ORIGIN env through docker-compose.