auth, headers: the examples are refused, HTTPS is insisted on

The server no longer starts with WORKSPACE_SECRET or WORKSPACE_PASSWORD
left at the value .env.example ships with. The secret was only checked
for length, and the public placeholder passed: anyone who had read the
repository could sign a session cookie for themselves. A secret under
32 characters is warned about.

With WORKSPACE_SECURE_COOKIE=1 the cookie is named __Host-diary_session,
which the browser keeps to this host and to HTTPS and which no sibling
subdomain can plant; turning it on logs everyone out once. Responses
then carry Strict-Transport-Security for a year. The traefik example
turns it on.

The password is compared as an HMAC under the secret, so the time a
comparison takes no longer depends on the configured password's length.

Every response also carries Cross-Origin-Opener-Policy and
Cross-Origin-Resource-Policy same-origin and a Permissions-Policy that
turns camera, microphone, location, payment and USB off; API answers
are no-store unless they say otherwise.

.env.example

@@ -22,7 +22,10 @@ WORKSPACE_SESSION_DAYS=30
 # to. Uploads stream to disk, so this bounds the disk, not the memory.
 WORKSPACE_MAX_UPLOAD_MB=1024
 
-# Set to 1 once the app is served over HTTPS, so the cookie gets `Secure`.
+# Set to 1 once the app is served over HTTPS: the cookie gets `Secure` and the
+# `__Host-` prefix (everyone is logged out once), and browsers are told to use
+# HTTPS only (HSTS). The server refuses to start with the example secret or
+# password above still in place.
 WORKSPACE_SECURE_COOKIE=0
 
 # --- SFTP mount --------------------------------------------------------------