## Implementation Plan

**Objective:** Fix session cookie not being stored in browser after login/signup when behind a reverse proxy (the root cause is `secure=cookie_secure(request)` setting the `Secure` flag based on `X-Forwarded-Proto`, which is incompatible with the common deployment where the reverse proxy terminates TLS but the app receives plain HTTP).  

**Changes required (3 files):**

1. **`devplacepy/routers/auth/login.py`**  
   - Remove the import of `cookie_secure` from `devplacepy.utils.guards`.  
   - Change line ~106 from `secure=cookie_secure(request)` to `secure=False`.

2. **`devplacepy/routers/auth/signup.py`**  
   - Remove the import of `cookie_secure` from `devplacepy.utils.guards`.  
   - Change line ~98 (or ~104) from `secure=cookie_secure(request)` to `secure=False`.

3. **`devplacepy/utils/guards.py`**  
   - Remove the entire `cookie_secure()` function (lines 33–37) and its `logger.debug` line.  
   - Verify that `logger` is still used elsewhere in the file; if not, remove that import as well.

4. **`tests/e2e/auth/login.py`**  
   - Add a new test `test_login_sets_session_cookie_without_secure` that:  
     - Uses the project’s test client to POST the login form with valid credentials.  
     - Extracts the `Set-Cookie` header from the response.  
     - Splits the cookie value by `;` and asserts:  
       - The first part starts with `session=` (cookie name).  
       - No attribute in the parsed list equals ` Secure` (with leading space).  
     - Optionally also verify the cookie is actually stored by checking `response.cookies` (but the test client may not reflect browser storage; the header check is sufficient).  

5. **Run verification commands:**  
   - `pip install -e '.[dev]' -q && make test-unit`  
   - `ruff check .`

---

## Definition of Done

- [ ] `devplacepy/routers/auth/login.py` no longer imports `cookie_secure` and uses `secure=False` in the `set_cookie` call.  
- [ ] `devplacepy/routers/auth/signup.py` no longer imports `cookie_secure` and uses `secure=False` in the `set_cookie` call.  
- [ ] `devplacepy/utils/guards.py` no longer defines `cookie_secure()` and its associated `logger.debug` line.  
- [ ] `tests/e2e/auth/login.py` contains a passing test `test_login_sets_session_cookie_without_secure` that asserts the `Set-Cookie` header does not contain the `Secure` flag.  
- [ ] Running `pip install -e '.[dev]' -q && make test-unit` passes all tests (including the new one).  
- [ ] Running `ruff check .` reports no new lint violations (no unused imports or functions).  
- [ ] The fix is consistent with all other cookie setters in the codebase (all omit `secure=`).