Backend session-cookie binding

Looks good to me. Claude was a little concerned about the default dev deployment, but it does seem like a standard pattern:

```
3. Session-cookie binding silently no-ops without SESSION_COOKIE_SECRET

backend/api/app/core/session_signing.py: the new require_session_cookie returns early (allow-all) when no secret is set,
and set_session_cookie only marks the cookie Secure outside DEV_ENVIRONMENTS (which defaults to development). A deploy
that forgets SESSION_COOKIE_SECRET and/or ENVIRONMENT therefore runs with binding fully disabled and/or an insecure
cookie, with no startup error. The docstring says this is intentional "opt-in" — but for a security control, failing open
silently is a foot-gun. Fix: require the secret (and a non-dev ENVIRONMENT) to be set explicitly in non-dev, or log a
loud warning at startup.
```

_Originally posted by @mvdbeek in https://github.com/galaxyproject/brc-analytics/pull/1301#pullrequestreview-4526428521_

Read backend/api/app/core/session_signing.py, focusing on require_session_cookie and set_session_cookie, then inspect startup configuration for SESSION_COOKIE_SECRET and ENVIRONMENT. Done means non-development deployments no longer silently run with binding disabled or insecure cookies, or emit the requested loud startup warning.

Written by the indexing model from the issue text.