kdlb9zs9n: Scaffold Next.js app and create the server session from a Minnect login

src/lib/cookie.ts

@@ -0,0 +1,22 @@
+// The single browser-facing cookie. It holds only an opaque session id,
+// never a Minnect token (ADR-001). httpOnly keeps it out of JavaScript.
+
+export const SESSION_COOKIE = "mfb_session";
+
+export interface SessionCookieOptions {
+  httpOnly: true;
+  secure: boolean;
+  sameSite: "lax";
+  path: "/";
+}
+
+export function sessionCookieOptions(): SessionCookieOptions {
+  return {
+    httpOnly: true,
+    // Secure is required in production (ADR-001). It is relaxed in local
+    // development so the cookie works over plain http on localhost.
+    secure: process.env.NODE_ENV !== "development",
+    sameSite: "lax",
+    path: "/",
+  };
+}