feat(scanner): add debounced file watching with polling fallback

- Implement event queue with 3-second debouncing for file system events
- Add configurable polling fallback (default 3 min) via SCAN_POLL_INTERVAL_MINUTES
- Add SyncFilesystemWithDatabase to detect orphaned DB entries and new files
- Integrate utils.ResolveMediaURL for consistent media file path resolution
- Add COOKIE_SECURE env var with SameSite=LaxMode for session cookies
- Update media handler to properly decode URL paths for file serving
- Refactor scanner initialization to accept poll interval configuration

internal/handlers/auth.go

@@ -6,6 +6,7 @@ import (
 	"context"
 	"fmt"
 	"net/http"
+	"os"
 	"path/filepath"
 	"strings"
 	"time"
@@ -29,6 +30,8 @@ const (
 // Note: This is computed from SessionDuration to avoid magic numbers
 var SessionDurationSec = int(SessionDuration.Seconds())
 
+var secure = os.Getenv("COOKIE_SECURE")
+
 type AuthHandler struct {
 	db                  *database.Queries
 	jwtKey              []byte
@@ -249,7 +252,8 @@ func (h *AuthHandler) Register(c echo.Context) error {
 		Value:    accessToken,
 		Path:     "/",
 		HttpOnly: true,
-		Secure:   false, // TODO: Set to true in production with HTTPS
+		Secure:   secure == "true", // TODO: Set to true in production with HTTPS
+		SameSite: http.SameSiteLaxMode,
 		MaxAge:   SessionDurationSec,
 	}
 	c.SetCookie(cookie)
@@ -394,7 +398,8 @@ func (h *AuthHandler) Login(c echo.Context) error {
 		Value:    accessToken,
 		Path:     "/",
 		HttpOnly: true,
-		Secure:   false, // TODO: Set to true in production with HTTPS
+		Secure:   secure == "true", // TODO: Set to true in production with HTTPS
+		SameSite: http.SameSiteLaxMode,
 		MaxAge:   SessionDurationSec,
 	}
 	c.SetCookie(cookie)