auth, headers: the examples are refused, HTTPS is insisted on

The server no longer starts with WORKSPACE_SECRET or WORKSPACE_PASSWORD
left at the value .env.example ships with. The secret was only checked
for length, and the public placeholder passed: anyone who had read the
repository could sign a session cookie for themselves. A secret under
32 characters is warned about.

With WORKSPACE_SECURE_COOKIE=1 the cookie is named __Host-diary_session,
which the browser keeps to this host and to HTTPS and which no sibling
subdomain can plant; turning it on logs everyone out once. Responses
then carry Strict-Transport-Security for a year. The traefik example
turns it on.

The password is compared as an HMAC under the secret, so the time a
comparison takes no longer depends on the configured password's length.

Every response also carries Cross-Origin-Opener-Policy and
Cross-Origin-Resource-Policy same-origin and a Permissions-Policy that
turns camera, microphone, location, payment and USB off; API answers
are no-store unless they say otherwise.

compose.override.yml.example

@@ -7,6 +7,9 @@ services:
     # Requires WORKSPACE_SFTP_BIND=0.0.0.0:2222 in .env to actually listen.
     ports: !override
       - "127.0.0.1:2222:2222"
+    # Traefik serves it over HTTPS, so the cookie can insist on it.
+    environment:
+      WORKSPACE_SECURE_COOKIE: "1"
     networks:
       - narl
       - internal_net