Complete Phase 1: goals, cookie auth, profile editing

Close the remaining Phase 1 DoD gaps and reconcile the browser flow with
the auth layer.

Goals (5 -> 7 prompts):
- Add near-term (6-12mo) and long-term (3-5yr) goal prompts; collect raw
  text on the conversation and store AI-articulated goal summaries on the
  profile. Extractor articulates the person's own stated goals (mirror,
  not compass) and never fabricates. Alembic 003 adds the four columns.

Cookie-based browser sessions (fixes frontend<->auth desync):
- OAuth callback now sets httpOnly session cookies and redirects into the
  app instead of returning JSON. get_current_user gains a cookie fallback
  (X-API-Key -> Bearer -> cookie). refresh/logout read the refresh cookie
  and set/clear cookies. New shared auth.js (authedFetch) sends cookies and
  silently refreshes on 401. Static pages drop the bogus user_id and call
  the correct /me endpoints.

Profile editing (read/edit/affirm):
- PATCH /discovery/profile/me edits the prose (Ikigai summaries, overlap
  narrative, goals); owner-scoped, partial update, 409 when locked. Edit
  mode in profile.html with Save/Cancel.

Also: bump default model to claude-sonnet-4-6, align ports to 8011
(OAuth redirect, CORS), add COOKIE_SECURE/POST_LOGIN_REDIRECT config, and
refresh the README to match the shipped behavior.

Tests: 33 passing (added cookie-auth, profile-edit, goal-extraction cases;
factored a shared app_client fixture into conftest.py).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

app/schemas.py

@@ -15,6 +15,8 @@ class RespondRequest(BaseModel):
     prompt_pull: str = ""
     prompt_recognition: str = ""
     prompt_future: str = ""
+    prompt_goals_short: str = ""
+    prompt_goals_long: str = ""
 
 
 class RespondResponse(BaseModel):
@@ -44,11 +46,27 @@ class ProfileResponse(BaseModel):
     mission_summary: Optional[str] = None
     vocation_summary: Optional[str] = None
     overlap_narrative: Optional[str] = None
+    short_term_goals: Optional[str] = None
+    long_term_goals: Optional[str] = None
     confidence: Optional[Confidence] = None
     locked: bool = False
     extraction_notes: Optional[str] = None
 
 
+class ProfileUpdate(BaseModel):
+    """Partial edit of a profile's prose. Only fields explicitly provided are
+    updated (see exclude_unset in the router). The AI's structural inference
+    (triad/type/wing/variant) and confidence are not editable here."""
+
+    love_summary: Optional[str] = None
+    strength_summary: Optional[str] = None
+    mission_summary: Optional[str] = None
+    vocation_summary: Optional[str] = None
+    overlap_narrative: Optional[str] = None
+    short_term_goals: Optional[str] = None
+    long_term_goals: Optional[str] = None
+
+
 class ConfirmResponse(BaseModel):
     status: str
 
@@ -63,5 +81,7 @@ class ConversationResponse(BaseModel):
     prompt_pull: Optional[str] = None
     prompt_recognition: Optional[str] = None
     prompt_future: Optional[str] = None
+    prompt_goals_short: Optional[str] = None
+    prompt_goals_long: Optional[str] = None
 
     model_config = {"from_attributes": True}