Complete Phase 1: goals, cookie auth, profile editing

Close the remaining Phase 1 DoD gaps and reconcile the browser flow with
the auth layer.

Goals (5 -> 7 prompts):
- Add near-term (6-12mo) and long-term (3-5yr) goal prompts; collect raw
  text on the conversation and store AI-articulated goal summaries on the
  profile. Extractor articulates the person's own stated goals (mirror,
  not compass) and never fabricates. Alembic 003 adds the four columns.

Cookie-based browser sessions (fixes frontend<->auth desync):
- OAuth callback now sets httpOnly session cookies and redirects into the
  app instead of returning JSON. get_current_user gains a cookie fallback
  (X-API-Key -> Bearer -> cookie). refresh/logout read the refresh cookie
  and set/clear cookies. New shared auth.js (authedFetch) sends cookies and
  silently refreshes on 401. Static pages drop the bogus user_id and call
  the correct /me endpoints.

Profile editing (read/edit/affirm):
- PATCH /discovery/profile/me edits the prose (Ikigai summaries, overlap
  narrative, goals); owner-scoped, partial update, 409 when locked. Edit
  mode in profile.html with Save/Cancel.

Also: bump default model to claude-sonnet-4-6, align ports to 8011
(OAuth redirect, CORS), add COOKIE_SECURE/POST_LOGIN_REDIRECT config, and
refresh the README to match the shipped behavior.

Tests: 33 passing (added cookie-auth, profile-edit, goal-extraction cases;
factored a shared app_client fixture into conftest.py).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

app/auth.py

@@ -28,6 +28,13 @@ from app.models import RefreshToken, User
 API_KEY_ADMIN_ID = "api-key-admin"
 JWT_ALGORITHM = "HS256"
 
+# Cookie names for the browser session. The refresh cookie is scoped to the
+# auth path so it is only ever sent to /api/auth/* (refresh, logout), not to
+# every discovery request.
+ACCESS_COOKIE = "access_token"
+REFRESH_COOKIE = "refresh_token"
+REFRESH_COOKIE_PATH = "/api/auth"
+
 oauth = OAuth()
 oauth.register(
     name="google",
@@ -55,6 +62,48 @@ def _refresh_days() -> int:
     return int(os.getenv("JWT_REFRESH_DAYS", "7"))
 
 
+def _cookie_secure() -> bool:
+    """Secure-by-default. Set COOKIE_SECURE=false for local http dev, where
+    Secure cookies would never be sent over plain http://localhost."""
+    return os.getenv("COOKIE_SECURE", "true").strip().lower() not in (
+        "false",
+        "0",
+        "no",
+    )
+
+
+def set_auth_cookies(
+    response, access_token: str, refresh_token: Optional[str] = None
+) -> None:
+    """Write the session as httpOnly cookies. Pass refresh_token only when it
+    rotates (login); a plain access refresh leaves the refresh cookie intact."""
+    secure = _cookie_secure()
+    response.set_cookie(
+        ACCESS_COOKIE,
+        access_token,
+        max_age=_access_minutes() * 60,
+        httponly=True,
+        secure=secure,
+        samesite="lax",
+        path="/",
+    )
+    if refresh_token is not None:
+        response.set_cookie(
+            REFRESH_COOKIE,
+            refresh_token,
+            max_age=_refresh_days() * 86400,
+            httponly=True,
+            secure=secure,
+            samesite="lax",
+            path=REFRESH_COOKIE_PATH,
+        )
+
+
+def clear_auth_cookies(response) -> None:
+    response.delete_cookie(ACCESS_COOKIE, path="/")
+    response.delete_cookie(REFRESH_COOKIE, path=REFRESH_COOKIE_PATH)
+
+
 def create_access_token(user_id: str, email: str) -> str:
     now = datetime.now(timezone.utc)
     payload = {
@@ -160,6 +209,22 @@ async def get_current_user(
         request.state.auth_source = "jwt"
         return user
 
+    # Browser session: the access token rides in an httpOnly cookie. An
+    # expired cookie decodes to 401, which the frontend recovers from by
+    # calling /api/auth/refresh.
+    cookie_token = request.cookies.get(ACCESS_COOKIE)
+    if cookie_token:
+        payload = decode_access_token(cookie_token)
+        user = await db.get(User, payload["sub"])
+        if user is None:
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                detail="User no longer exists",
+            )
+        request.state.user = user
+        request.state.auth_source = "cookie"
+        return user
+
     raise HTTPException(
         status_code=status.HTTP_401_UNAUTHORIZED,
         detail="Not authenticated",