Lucas Berger
7d61148415
feat(19-01): implement localSession JWT cookie helpers and assertLocalSessionSecretSet boot guard
- localSession.ts: issueLocalSessionCookie/verifyLocalSessionCookie/clearLocalSessionCookie
- Jwt namespace import from hono/utils/jwt (Pitfall 8 — not named sign/verify)
- Cookie name: 'local-session' (distinct from 'oidc-auth', Pitfall 4)
- httpOnly, sameSite=Lax, secure in production; try/catch on Jwt.verify (Pitfall 9)
- verifyLocalSessionCookie returns null (never throws) on any error
- bootGuards.ts: assertLocalSessionSecretSet — exit(1) if secret missing/<32 chars
- Exempt when DEV_AUTH_BYPASS=true (bypass doesn't issue local-session cookies)
- index.ts: wire assertLocalSessionSecretSet() after assertNotDevBypassInProduction()
- All 5 unit tests pass; typecheck exits 0