Make auth cookie SameSite configurable

Add same-site to auth cookie config with lax as the default,
PROBOD_AUTH_COOKIE_SAMESITE bootstrap mapping, and validation
that rejects none unless Secure is enabled.

Signed-off-by: Cursor Agent <cursoragent@cursor.com>

Co-authored-by: Bryan FRIMIN <bryan@frimin.fr>

contrib/helm/charts/probo/templates/deployment.yaml

@@ -135,6 +135,8 @@ spec:
                   key: cookie-secret
             - name: PROBOD_AUTH_COOKIE_DURATION
               value: {{ .Values.probo.auth.cookieDuration | quote }}
+            - name: PROBOD_AUTH_COOKIE_SAMESITE
+              value: {{ .Values.probo.auth.cookieSameSite | quote }}
             - name: PROBOD_AUTH_PASSWORD_PEPPER
               valueFrom:
                 secretKeyRef:

contrib/helm/charts/probo/values.yaml

@@ -229,6 +229,8 @@ probo:
     emailConfirmationTokenValidity: 3600
     cookieName: "SSID"
     cookieDomain: "probo.example.com"
+    # lax, strict, or none (none requires HTTPS / secure cookies)
+    cookieSameSite: "lax"
     # REQUIRED: Generate with openssl rand -base64 32
     cookieSecret: ""
     cookieDuration: 24