fix: Make session cookie options explicit

Add explicit httpOnly, sameSite, and path options to session cookie
configuration. These match iron-session defaults but make the
configuration self-documenting and resilient to library changes.