Complete Phase 1: goals, cookie auth, profile editing

Close the remaining Phase 1 DoD gaps and reconcile the browser flow with
the auth layer.

Goals (5 -> 7 prompts):
- Add near-term (6-12mo) and long-term (3-5yr) goal prompts; collect raw
  text on the conversation and store AI-articulated goal summaries on the
  profile. Extractor articulates the person's own stated goals (mirror,
  not compass) and never fabricates. Alembic 003 adds the four columns.

Cookie-based browser sessions (fixes frontend<->auth desync):
- OAuth callback now sets httpOnly session cookies and redirects into the
  app instead of returning JSON. get_current_user gains a cookie fallback
  (X-API-Key -> Bearer -> cookie). refresh/logout read the refresh cookie
  and set/clear cookies. New shared auth.js (authedFetch) sends cookies and
  silently refreshes on 401. Static pages drop the bogus user_id and call
  the correct /me endpoints.

Profile editing (read/edit/affirm):
- PATCH /discovery/profile/me edits the prose (Ikigai summaries, overlap
  narrative, goals); owner-scoped, partial update, 409 when locked. Edit
  mode in profile.html with Save/Cancel.

Also: bump default model to claude-sonnet-4-6, align ports to 8011
(OAuth redirect, CORS), add COOKIE_SECURE/POST_LOGIN_REDIRECT config, and
refresh the README to match the shipped behavior.

Tests: 33 passing (added cookie-auth, profile-edit, goal-extraction cases;
factored a shared app_client fixture into conftest.py).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

app/static/auth.js

@@ -0,0 +1,33 @@
+// Shared client-side auth helpers.
+//
+// The session lives entirely in httpOnly cookies that the server sets at
+// /api/auth/callback, so there are no tokens for the page to store or read.
+// We just send the cookies with every request and recover from access-token
+// expiry by silently refreshing once before giving up and sending the user
+// back through Google.
+
+function redirectToLogin() {
+  window.location.href = "/api/auth/login";
+}
+
+// fetch() wrapper that always sends the session cookies. On a 401 it attempts
+// a single silent refresh (the refresh cookie is scoped to /api/auth) and
+// retries the original request; if that still fails, it bounces to login.
+async function authedFetch(url, options = {}) {
+  const opts = { credentials: "include", ...options };
+
+  let res = await fetch(url, opts);
+  if (res.status !== 401) return res;
+
+  const refreshed = await fetch("/api/auth/refresh", {
+    method: "POST",
+    credentials: "include",
+  });
+  if (refreshed.ok) {
+    res = await fetch(url, opts);
+    if (res.status !== 401) return res;
+  }
+
+  redirectToLogin();
+  throw new Error("Not authenticated");
+}