Complete Phase 1: goals, cookie auth, profile editing

Close the remaining Phase 1 DoD gaps and reconcile the browser flow with
the auth layer.

Goals (5 -> 7 prompts):
- Add near-term (6-12mo) and long-term (3-5yr) goal prompts; collect raw
  text on the conversation and store AI-articulated goal summaries on the
  profile. Extractor articulates the person's own stated goals (mirror,
  not compass) and never fabricates. Alembic 003 adds the four columns.

Cookie-based browser sessions (fixes frontend<->auth desync):
- OAuth callback now sets httpOnly session cookies and redirects into the
  app instead of returning JSON. get_current_user gains a cookie fallback
  (X-API-Key -> Bearer -> cookie). refresh/logout read the refresh cookie
  and set/clear cookies. New shared auth.js (authedFetch) sends cookies and
  silently refreshes on 401. Static pages drop the bogus user_id and call
  the correct /me endpoints.

Profile editing (read/edit/affirm):
- PATCH /discovery/profile/me edits the prose (Ikigai summaries, overlap
  narrative, goals); owner-scoped, partial update, 409 when locked. Edit
  mode in profile.html with Save/Cancel.

Also: bump default model to claude-sonnet-4-6, align ports to 8011
(OAuth redirect, CORS), add COOKIE_SECURE/POST_LOGIN_REDIRECT config, and
refresh the README to match the shipped behavior.

Tests: 33 passing (added cookie-auth, profile-edit, goal-extraction cases;
factored a shared app_client fixture into conftest.py).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

app/services/extractor.py

@@ -11,7 +11,7 @@ from typing import Any, Dict
 
 from anthropic import AsyncAnthropic
 
-DEFAULT_MODEL = "claude-sonnet-4-5"
+DEFAULT_MODEL = "claude-sonnet-4-6"
 MAX_TOKENS = 2000
 
 # Ordered mapping of response keys -> the human-facing prompt label, used to
@@ -22,6 +22,8 @@ PROMPT_LABELS = {
     "pull": "The Natural Pull",
     "recognition": "The Recognition Moment",
     "future": "The Future Pull",
+    "goals_short": "Near-Term Goals (6–12 months)",
+    "goals_long": "Long-Term Goals (3–5 years)",
 }
 
 # Keys the model must return for a profile to be considered well-formed.
@@ -36,6 +38,8 @@ REQUIRED_KEYS = (
     "mission_summary",
     "vocation_summary",
     "overlap_narrative",
+    "short_term_goals",
+    "long_term_goals",
     "confidence",
 )
 REQUIRED_CONFIDENCE_KEYS = ("triad", "type", "variant", "ikigai")
@@ -60,6 +64,13 @@ IKIGAI EXTRACTION RULES:
 - Mission: what problem or need in the world their stories orbit around
 - Vocation: where their strength and the world's need intersect with economic potential
 
+GOAL ARTICULATION RULES:
+- The last two responses are the person's own near-term (6-12 month) and long-term (3-5 year) goals.
+- You are a MIRROR, not a compass. Articulate the goals THEY stated — clarify and sharpen their own words, connecting each goal to the Ikigai and enneagram pattern you found. Never invent goals, never prescribe a direction, never substitute your judgment for theirs.
+- If a goal response is vague, reflect back the direction you can hear in it and note in extraction_notes that it is still forming — do not fill the gap with goals of your own.
+- If a goal response is empty, return an empty string for that field. Do not fabricate.
+- Write each goal summary directly to the person in second person (you/your), 2-4 sentences.
+
 CONFIDENCE RULES:
 - high: strong consistent signal across 2+ responses
 - medium: signal present but only in one response or partially contradicted
@@ -79,6 +90,8 @@ Respond ONLY with valid JSON. No preamble, no explanation, no markdown fences.
   "mission_summary": "2-3 sentence summary of what the world needs from them",
   "vocation_summary": "2-3 sentence summary of what they can be paid for",
   "overlap_narrative": "One paragraph (4-6 sentences) describing where their four Ikigai circles converge and how their enneagram type shapes that intersection. Write directly to the person in second person (you/your). Do not mention enneagram type numbers — describe the pattern in plain language.",
+  "short_term_goals": "2-4 sentences articulating the person's OWN stated near-term (6-12 month) goals, clarified and connected to their pattern. Empty string if they gave no goal.",
+  "long_term_goals": "2-4 sentences articulating the person's OWN stated long-term (3-5 year) goals, clarified and connected to their pattern. Empty string if they gave no goal.",
   "confidence": {
     "triad": "high | medium | low",
     "type": "high | medium | low",