Add public curator notes and U-shaped hall wall hang.

Paintings get editable curator notes with brass plates in the 3D hall, and visit order now uses the far/end wall between left and right.

Co-authored-by: Cursor <cursoragent@cursor.com>

server/middleware/session.js

@@ -4,6 +4,17 @@ const pool = require('../db');
 
 const SEVEN_DAYS_MS = 7 * 24 * 60 * 60 * 1000;
 
+function resolveCookieSecure() {
+  const flag = process.env.SESSION_COOKIE_SECURE;
+  if (flag === '1' || flag === 'true') return true;
+  if (flag === '0' || flag === 'false') return false;
+  // Behind Keenetic/HTTPS termination: match the browser scheme via X-Forwarded-Proto.
+  if (process.env.TRUST_PROXY === '1' || process.env.TRUST_PROXY === 'true') {
+    return 'auto';
+  }
+  return false;
+}
+
 function createSessionMiddleware() {
   const secret = process.env.SESSION_SECRET;
   if (!secret) {
@@ -12,10 +23,6 @@ function createSessionMiddleware() {
     );
   }
 
-  const secureCookie =
-    process.env.SESSION_COOKIE_SECURE === '1' ||
-    process.env.SESSION_COOKIE_SECURE === 'true';
-
   return session({
     store: new pgSession({
       pool,
@@ -28,7 +35,7 @@ function createSessionMiddleware() {
     saveUninitialized: false,
     cookie: {
       httpOnly: true,
-      secure: secureCookie,
+      secure: resolveCookieSecure(),
       sameSite: 'lax',
       maxAge: SEVEN_DAYS_MS,
     },