Fix critical auth bug: set httpOnly cookie on local login/register

After the hybrid auth migration, web users log in but the
setAuthCookie() helper was never actually called in /login or
/register — only in the OIDC callback. Result: local sign-in worked
until the first page reload, then the user appeared logged out. The
Settings page's Active Sessions list came up empty because
/api/sessions received no auth.

Added setAuthCookie(res, token) calls on successful:
  - /register (auto-verified first admin path)
  - /login (after TOTP / backup code verification)

Mobile is unaffected — it uses Bearer from Keychain and always has.

src/routes/auth.js

@@ -240,6 +240,7 @@ router.post('/register', async (req, res) => {
         await db.run('INSERT INTO user_sessions (id, user_id, token_hash, ip_address, user_agent, device_label) VALUES (?, ?, ?, ?, ?, ?)',
           [regSessionId, userId, hashToken(token), req.ip, req.headers['user-agent'] || '', parseUserAgent(req.headers['user-agent'])]);
       } catch (e) { /* table may not exist yet */ }
+      setAuthCookie(res, token);
       return res.json({
         success: true, token: token, sessionId: regSessionId,
         user: { id: userId, email: email.toLowerCase(), name: name, role: role, email_verified: true },
@@ -376,6 +377,7 @@ router.post('/login', async (req, res) => {
     // Notify user of new login (fire-and-forget)
     notifyNewLogin(user.id, parseUserAgent(req.headers['user-agent']), req.ip);
 
+    setAuthCookie(res, token);
     res.json({
       success: true, token: token, sessionId: sessionId,
       user: { id: user.id, email: user.email, name: user.name, role: user.role, totp_enabled: user.totp_enabled, email_verified: user.email_verified }