feat: session mode parsing, memory-only cookies, single-user mode

- COOKIE_SECURE env now accepts: 'true' (secure), 'false' (memory-only), 'single_user' (no cookie)
- config.parse_cookie_mode() returns (COOKIE_SECURE, SINGLE_USER) tuple for routing
- single_user_owner() returns oldest Owner for test/local deployments
- session cookie respects mode: Max-Age only in secure mode, dropped for memory-only
- base.html renders ephemeral-session and single-user banners per mode
- Tests: comprehensive coverage for all three modes with monkeypatch configs
- CLAUDE.md + README docs updated

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

README.md

@@ -52,7 +52,7 @@ Set these under `environment:` in `docker-compose.yml`.
 |------------------|---------|--------------------------------------------------|
 | `DATA_DIR`       | `/data` | Storage root for the SQLite DB, drivers and icons. Should map to the `imptune_data` volume. |
 | `PORT`           | `8000`  | Port the server listens on inside the container. |
-| `COOKIE_SECURE`  | `true`  | `Secure` flag on the session cookie. Set to `false` when the app is reached over plain HTTP — see below. |
+| `COOKIE_SECURE`  | `true`  | Session mode: `true` (Secure cookie), `false` (plain-HTTP cookie, memory-only) or `single_user` (no cookie, one shared store) — see below. |
 
 ### `COOKIE_SECURE` and HTTPS
 
@@ -91,3 +91,34 @@ export DATA_DIR=/tmp/imptune_data
 export COOKIE_SECURE=false
 uvicorn imptune.main:app --reload --port 8000
 ```
+
+### `COOKIE_SECURE=single_user` — no sessions at all
+
+For a test box or a local deployment used by one person, sessions are pure
+friction. `COOKIE_SECURE=single_user` (also accepted: `single-user`, `single`)
+drops them:
+
+- No cookie is read or set. Every request — every browser, every device, curl —
+  resolves to **one shared owner**, so all printers, print defaults and clients
+  are simply "the server's".
+- The onboarding modal, the memory-only warning, the "This session" sidebar menu
+  and both `/session/*` key routes disappear (the routes return `404`). There is
+  no backup key to lose, and none to hand out.
+- Every page shows a banner stating that whoever reaches the app sees the same
+  data.
+
+**There is no isolation left in this mode**, so put it only where reaching the
+app is already the permission — localhost, or a network you trust. Switching an
+existing deployment over adopts the oldest existing owner, so printers saved
+under a cookie stay visible; switching back re-enables cookie scoping and hands
+new browsers a fresh empty session (that same data is then reachable only with
+its key, which single-user mode never printed — download a backup key *before*
+switching if you may switch back).
+
+```yaml
+services:
+  imptune:
+    environment:
+      - DATA_DIR=/data
+      - COOKIE_SECURE=single_user
+```