Fix local live preview auth cookies

[mrubens]

Summary

• always mark preview authentication cookies as Secure when using SameSite=None and Partitioned
• apply the cookie contract to both iframe token bootstrap and auth callback flows
• add regression coverage for local HTTP preview callbacks and iframe authentication

Validation

• 147 preview-proxy tests passed
• preview-proxy typecheck passed
• preview-proxy lint passed
• pre-push lint:fast, check-types:fast, and knip passed
• verified in Chrome that the ngrok-hosted Roomote page renders the local Sunny Acres preview in the side pane

[roomote-roomote]

No code issues found. See task

Reviewed the switch to always marking preview auth cookies as Secure for the iframe token bootstrap (apps/preview-proxy/src/handlers/http.ts) and auth callback (apps/preview-proxy/src/handlers/auth-callback.ts) flows, plus the added regression coverage. Since SameSite=None cookies already require Secure and browsers treat localhost/*.localhost as trustworthy for HTTP, dropping shouldSetSecure is a correct simplification with no behavioral regression for supported origins. Both cookie-setting sites are consistent, and the removed isLoopbackHostname import has no remaining references.