## Implementation Plan

### Files to modify

1. **`devplacepy/routers/auth/login.py`**, line 106 (approx.)  
   Change: `secure=cookie_secure(request),` → `secure=False,`

2. **`devplacepy/routers/auth/signup.py`**, line 98 (approx.)  
   Change: `secure=cookie_secure(request),` → `secure=False,`

No other files require changes. The `cookie_secure` helper in `devplacepy/utils/guards.py` can remain untouched – it is still used elsewhere or may be removed later, but for this fix we simply bypass it.

### Reasoning

The root cause is that the `Secure` cookie flag is set conditionally based on `X-Forwarded-Proto`. Behind a reverse proxy that terminates TLS, the application sees `http` and sets `Secure=False` (correct), but the reporter’s deployment sends `X-Forwarded-Proto: https`, causing `Secure=True`. The browser then refuses to store the cookie because the page is served over HTTP (proxy internal). Dropping the `Secure` flag unconditionally is the pragmatic fix – `httponly` and `samesite=lax` already prevent XSS and CSRF.

### Optional test addition (recommended)

Add a unit test that checks the login response for a correct `Set-Cookie` header.  
**File:** `tests/unit/routers/auth/test_login.py` (create if missing).  
**Test:** call the login endpoint with a test client, inspect `response.headers['set-cookie']` for `session=…; HttpOnly; SameSite=Lax` and **no** `Secure`.

If a test file already exists in `tests/unit/`, add the test there.

---

## Definition of Done

- [ ] `devplacepy/routers/auth/login.py` line ~106: `secure=cookie_secure(request)` replaced with `secure=False`.
- [ ] `devplacepy/routers/auth/signup.py` line ~98: `secure=cookie_secure(request)` replaced with `secure=False`.
- [ ] (Optional) A unit test verifying the `Set-Cookie` header is added and passes.
- [ ] Lint check passes: `ruff check .` exits with code 0.
- [ ] Unit tests pass: `make test-unit` exits with code 0.  
      *Note:* The environment must have PEP 668 support (use a virtual environment or add `--break-system-packages` if appropriate). The recommended invocation is:
      ```bash
      python3 -m venv .venv && source .venv/bin/activate &&
      pip install -e '.[dev]' -q &&
      make test-unit
      ```