Add secure cookie attributes (httponly, secure, samesite) in appproxy

## Problem

Cookies are being set without security attributes, making them vulnerable to:

- **XSS attacks** (missing `httponly`)
- **Man-in-the-middle attacks** (missing `secure`)
- **CSRF attacks** (missing `samesite`)

## Affected Files

- `src/ai/backend/appproxy/worker/api/setup.py:171`

## Scanner Reference

- **Sparrow**: INSECURE_PERSISTENT_COOKIE - Issues #1686, #1687, #1688
- **CWE**: CWE-614 (Sensitive Cookie Without 'Secure' Flag)

## Recommended Fix

Add security attributes when setting cookies:

```python
response.set_cookie(
name,
value,
httponly=True,
secure=True,
samesite='Lax' # or 'Strict' depending on requirements
)
```

JIRA Issue: BA-3201