feat: session mode parsing, memory-only cookies, single-user mode

- COOKIE_SECURE env now accepts: 'true' (secure), 'false' (memory-only), 'single_user' (no cookie)
- config.parse_cookie_mode() returns (COOKIE_SECURE, SINGLE_USER) tuple for routing
- single_user_owner() returns oldest Owner for test/local deployments
- session cookie respects mode: Max-Age only in secure mode, dropped for memory-only
- base.html renders ephemeral-session and single-user banners per mode
- Tests: comprehensive coverage for all three modes with monkeypatch configs
- CLAUDE.md + README docs updated

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

imptune/config.py

@@ -7,8 +7,28 @@ load_dotenv()
 
 DATA_DIR = os.environ.get("DATA_DIR", "/data")
 PORT = int(os.environ.get("PORT", "8000"))
-# Set to "false" for local plain-HTTP dev — browsers drop Secure cookies over HTTP.
-COOKIE_SECURE = os.environ.get("COOKIE_SECURE", "true").lower() != "false"
+
+_SINGLE_USER_VALUES = frozenset({"single_user", "single-user", "singleuser", "single"})
+
+
+def parse_cookie_mode(raw: str) -> tuple[bool, bool]:
+    """Read `COOKIE_SECURE` as a three-way mode → `(cookie_secure, single_user)`.
+
+    - `true` (default): cookie-scoped Owners, `Secure` + persistent cookie.
+    - `false`: cookie-scoped Owners over plain HTTP, memory-only cookie —
+      browsers drop `Secure` cookies on HTTP, so the flag has to come off.
+    - `single_user`: no cookie at all. Every request shares one Owner, so a
+      test box or a local single-person deployment needs no session plumbing.
+      Anyone who can reach the app gets that data — there is no separation
+      left to enforce, which is the point.
+    """
+    value = raw.strip().lower()
+    if value in _SINGLE_USER_VALUES:
+        return False, True
+    return value != "false", False
+
+
+COOKIE_SECURE, SINGLE_USER = parse_cookie_mode(os.environ.get("COOKIE_SECURE", "true"))
 
 DB_PATH = str(Path(DATA_DIR) / "imptune.db")
 DRIVERS_DIR = str(Path(DATA_DIR) / "drivers")