feat: session mode parsing, memory-only cookies, single-user mode

- COOKIE_SECURE env now accepts: 'true' (secure), 'false' (memory-only), 'single_user' (no cookie)
- config.parse_cookie_mode() returns (COOKIE_SECURE, SINGLE_USER) tuple for routing
- single_user_owner() returns oldest Owner for test/local deployments
- session cookie respects mode: Max-Age only in secure mode, dropped for memory-only
- base.html renders ephemeral-session and single-user banners per mode
- Tests: comprehensive coverage for all three modes with monkeypatch configs
- CLAUDE.md + README docs updated

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

docker-compose.yml

@@ -17,6 +17,9 @@ services:
       # drops it and every request mints a new empty Owner. With `false` the
       # session works but lives only until the browser closes, and the UI warns.
       # - COOKIE_SECURE=false
+      # Or drop sessions entirely — no cookie, one shared store for everyone who
+      # can reach the app. Test boxes / single-person local prod only.
+      # - COOKIE_SECURE=single_user
 
 volumes:
   imptune_data: