feat: harden control panel authentication

docker-compose.control-panel.local.yml

@@ -31,6 +31,7 @@ services:
       CASAN_PREFLIGHT: ${CASAN_PREFLIGHT:-0}
       CASAN_AUTH_BRIDGE_URL: http://host.docker.internal:20130
       CASAN_AUTH_BRIDGE_TOKEN: ${CASAN_AUTH_BRIDGE_TOKEN:-}
+      CASAN_PROVIDER_ACCOUNT_AUTH_ENABLED: "1"
     volumes:
       - ./.specify:/app/.specify
       - ./docs/output:/app/docs/output:ro
@@ -73,6 +74,10 @@ services:
       - --whitelist-domain=localhost:18443
       - --cookie-secret=0123456789abcdef0123456789abcdef
       - --cookie-secure=true
+      - --cookie-httponly=true
+      - --cookie-samesite=lax
+      - --cookie-expire=8h
+      - --cookie-refresh=1h
       - --email-domain=*
       - --scope=openid email profile groups
       - --oidc-groups-claim=groups