[Security][MEDIUM] Session cookie set with SameSite=None

## Summary

Harper's session cookie is issued with `SameSite=None; Secure` by default, which instructs browsers to include it in all cross-origin requests. While Origin-header validation currently blocks cross-origin authenticated requests, `SameSite=None` is defense-in-depth debt.

**Observed header:**
```
Set-Cookie: -hdb-session=...; Path=/; HttpOnly; SameSite=None; Secure
```

## Risk

Any future weakening of the Origin check — or changes in how browsers handle this attribute — would immediately re-expose CSRF. With `SameSite=None`, a malicious website can trigger cookie inclusion on cross-origin requests. Current mitigations suppress the attack, but this attribute should not be the last line of defence.

## Recommendation

Change the default `SameSite` attribute to `Lax` (or `Strict`).

- `SameSite=Lax` still allows top-level navigations while blocking subresource and fetch-based CSRF.
- `SameSite=Strict` is appropriate when the application is only ever accessed on its own origin.

Ideally expose this as a configurable option in `harperdb-config.yaml` (e.g. `authentication.cookie.sameSite`) so operators can choose the right value for their deployment without patching Harper itself. The default should be `Lax` unless there is a concrete cross-site use case that requires `None`.

## Severity

**Medium** — mitigated by Origin-header checks today, but represents exploitable exposure if those checks are ever relaxed.