Agents for the way you work

I found the issue. In auth/session.ts, the token is stored in memory but never written to the cookie:

// line 42 — token set in memory only
sessionStore.set(token);

// missing: persist to httpOnly cookie
// res.cookie('session', token, {
//   httpOnly: true, secure: true
// });

The fix is to write the token to an httpOnly cookie alongside the in-memory store. I'll also add sameSite: 'lax' for CSRF protection.

Done — pushed to fix/session-persist and opened a PR. The cookie now persists across reloads with httpOnly + secure + sameSite flags.