Complete Phase 1: goals, cookie auth, profile editing

Close the remaining Phase 1 DoD gaps and reconcile the browser flow with
the auth layer.

Goals (5 -> 7 prompts):
- Add near-term (6-12mo) and long-term (3-5yr) goal prompts; collect raw
  text on the conversation and store AI-articulated goal summaries on the
  profile. Extractor articulates the person's own stated goals (mirror,
  not compass) and never fabricates. Alembic 003 adds the four columns.

Cookie-based browser sessions (fixes frontend<->auth desync):
- OAuth callback now sets httpOnly session cookies and redirects into the
  app instead of returning JSON. get_current_user gains a cookie fallback
  (X-API-Key -> Bearer -> cookie). refresh/logout read the refresh cookie
  and set/clear cookies. New shared auth.js (authedFetch) sends cookies and
  silently refreshes on 401. Static pages drop the bogus user_id and call
  the correct /me endpoints.

Profile editing (read/edit/affirm):
- PATCH /discovery/profile/me edits the prose (Ikigai summaries, overlap
  narrative, goals); owner-scoped, partial update, 409 when locked. Edit
  mode in profile.html with Save/Cancel.

Also: bump default model to claude-sonnet-4-6, align ports to 8011
(OAuth redirect, CORS), add COOKIE_SECURE/POST_LOGIN_REDIRECT config, and
refresh the README to match the shipped behavior.

Tests: 33 passing (added cookie-auth, profile-edit, goal-extraction cases;
factored a shared app_client fixture into conftest.py).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.env.example

@@ -4,13 +4,13 @@ HOST_BIND_IP=0.0.0.0
 HOST_PORT=8011
 
 # Optional: override the Anthropic model used for extraction
-ANTHROPIC_MODEL=claude-sonnet-4-5
+ANTHROPIC_MODEL=claude-sonnet-4-6
 
 # Google OAuth (web client type). Register the redirect URI below as an
 # authorized redirect URI in the Google Cloud Console for this client.
 GOOGLE_CLIENT_ID=xxxx.apps.googleusercontent.com
 GOOGLE_CLIENT_SECRET=GOCSPX-xxxx
-OAUTH_REDIRECT_URI=http://localhost:8000/api/auth/callback
+OAUTH_REDIRECT_URI=http://localhost:8011/api/auth/callback
 
 # Random 64-char URL-safe strings. Generate with:
 #   python -c "import secrets; print(secrets.token_urlsafe(48))"
@@ -21,8 +21,15 @@ IMPACTFLOW_API_KEY=generate-another-random-64-char-string
 JWT_ACCESS_MINUTES=15
 JWT_REFRESH_DAYS=7
 
+# Browser session cookies. COOKIE_SECURE must be true in production (HTTPS);
+# set it false ONLY for local http://localhost dev, where Secure cookies are
+# never sent. POST_LOGIN_REDIRECT is where the OAuth callback lands the
+# browser after setting the session cookies.
+COOKIE_SECURE=false
+POST_LOGIN_REDIRECT=/static/discovery.html
+
 # Comma-separated allow-list of browser origins for CORS.
-CORS_ALLOWED_ORIGINS=http://localhost:8000,http://100.103.206.4:8000
+CORS_ALLOWED_ORIGINS=http://localhost:8011,http://100.103.206.4:8011
 
 # Optional comma-separated email-domain allow-list (e.g. "computerim.com").
 # Empty means any verified Google email is accepted.