Complete Phase 1: goals, cookie auth, profile editing

Close the remaining Phase 1 DoD gaps and reconcile the browser flow with
the auth layer.

Goals (5 -> 7 prompts):
- Add near-term (6-12mo) and long-term (3-5yr) goal prompts; collect raw
  text on the conversation and store AI-articulated goal summaries on the
  profile. Extractor articulates the person's own stated goals (mirror,
  not compass) and never fabricates. Alembic 003 adds the four columns.

Cookie-based browser sessions (fixes frontend<->auth desync):
- OAuth callback now sets httpOnly session cookies and redirects into the
  app instead of returning JSON. get_current_user gains a cookie fallback
  (X-API-Key -> Bearer -> cookie). refresh/logout read the refresh cookie
  and set/clear cookies. New shared auth.js (authedFetch) sends cookies and
  silently refreshes on 401. Static pages drop the bogus user_id and call
  the correct /me endpoints.

Profile editing (read/edit/affirm):
- PATCH /discovery/profile/me edits the prose (Ikigai summaries, overlap
  narrative, goals); owner-scoped, partial update, 409 when locked. Edit
  mode in profile.html with Save/Cancel.

Also: bump default model to claude-sonnet-4-6, align ports to 8011
(OAuth redirect, CORS), add COOKIE_SECURE/POST_LOGIN_REDIRECT config, and
refresh the README to match the shipped behavior.

Tests: 33 passing (added cookie-auth, profile-edit, goal-extraction cases;
factored a shared app_client fixture into conftest.py).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/test_auth.py

@@ -1,48 +1,7 @@
 """Tests for the auth module: dual-auth dependency, JWT issue/decode,
-domain allow-list. Uses a temp SQLite DB so it doesn't touch the real one.
+domain allow-list. The `app_client` fixture (tests/conftest.py) provides an
+isolated app + temp DB so these never touch the real database.
 """
-import os
-
-import pytest
-from httpx import ASGITransport, AsyncClient
-
-
-@pytest.fixture
-async def app_client(tmp_path, monkeypatch):
-    """Spin up a fresh app with an isolated DB and known auth secrets."""
-    db_path = tmp_path / "auth_test.db"
-    monkeypatch.setenv(
-        "DATABASE_URL", f"sqlite+aiosqlite:///{db_path}"
-    )
-    monkeypatch.setenv("JWT_SECRET", "test-jwt-secret")
-    monkeypatch.setenv("IMPACTFLOW_API_KEY", "test-api-key")
-    monkeypatch.setenv("GOOGLE_CLIENT_ID", "fake-client-id")
-    monkeypatch.setenv("GOOGLE_CLIENT_SECRET", "fake-client-secret")
-    monkeypatch.setenv("ALLOWED_EMAIL_DOMAINS", "")
-
-    # Re-import in a way that picks up the patched env. The simplest way is
-    # to clear modules that read env at import time.
-    import importlib
-    import sys
-
-    for mod in list(sys.modules):
-        if mod.startswith("app"):
-            del sys.modules[mod]
-
-    from app import database
-    importlib.reload(database)
-    from app.database import Base, engine
-
-    from app.main import app
-
-    async with engine.begin() as conn:
-        await conn.run_sync(Base.metadata.create_all)
-
-    transport = ASGITransport(app=app)
-    async with AsyncClient(
-        transport=transport, base_url="http://test"
-    ) as client:
-        yield client
 
 
 async def test_unauthenticated_request_returns_401(app_client):
@@ -103,6 +62,95 @@ async def test_valid_jwt_authenticates(app_client, tmp_path):
     assert r.json()["role"] == "user"
 
 
+async def test_cookie_access_token_authenticates(app_client):
+    """A valid access token in the httpOnly cookie authenticates the browser."""
+    from datetime import datetime, timezone
+    from app.auth import create_access_token
+    from app.database import AsyncSessionLocal
+    from app.models import User
+
+    async with AsyncSessionLocal() as db:
+        db.add(User(
+            id="u-cookie",
+            email="cookie@example.com",
+            display_name="Cookie User",
+            google_id="g-cookie",
+            role="user",
+            created_at=datetime.now(timezone.utc),
+        ))
+        await db.commit()
+
+    token = create_access_token("u-cookie", "cookie@example.com")
+    r = await app_client.get("/api/me", cookies={"access_token": token})
+    assert r.status_code == 200
+    assert r.json()["email"] == "cookie@example.com"
+
+
+async def test_refresh_via_cookie_sets_new_access_cookie(app_client):
+    """POST /api/auth/refresh with only the refresh cookie mints a new access
+    token and writes it back as a cookie (no JSON body required)."""
+    from datetime import datetime, timezone
+    from app.auth import issue_refresh_token
+    from app.database import AsyncSessionLocal
+    from app.models import User
+
+    async with AsyncSessionLocal() as db:
+        user = User(
+            id="u-refresh",
+            email="refresh@example.com",
+            display_name="Refresh User",
+            google_id="g-refresh",
+            role="user",
+            created_at=datetime.now(timezone.utc),
+        )
+        db.add(user)
+        await db.commit()
+        raw_refresh = await issue_refresh_token(db, user, "pytest")
+
+    r = await app_client.post(
+        "/api/auth/refresh", cookies={"refresh_token": raw_refresh}
+    )
+    assert r.status_code == 200
+    assert r.json()["access_token"]
+    # The response re-sets the access cookie, and it actually authenticates.
+    new_access = r.cookies.get("access_token")
+    assert new_access
+    me = await app_client.get("/api/me", cookies={"access_token": new_access})
+    assert me.status_code == 200
+    assert me.json()["email"] == "refresh@example.com"
+
+
+async def test_logout_revokes_refresh_token(app_client):
+    """Logout via the refresh cookie revokes it, so a later refresh fails."""
+    from datetime import datetime, timezone
+    from app.auth import issue_refresh_token
+    from app.database import AsyncSessionLocal
+    from app.models import User
+
+    async with AsyncSessionLocal() as db:
+        user = User(
+            id="u-logout",
+            email="logout@example.com",
+            display_name="Logout User",
+            google_id="g-logout",
+            role="user",
+            created_at=datetime.now(timezone.utc),
+        )
+        db.add(user)
+        await db.commit()
+        raw_refresh = await issue_refresh_token(db, user, "pytest")
+
+    out = await app_client.post(
+        "/api/auth/logout", cookies={"refresh_token": raw_refresh}
+    )
+    assert out.status_code == 200
+
+    again = await app_client.post(
+        "/api/auth/refresh", cookies={"refresh_token": raw_refresh}
+    )
+    assert again.status_code == 401
+
+
 async def test_oauth_login_redirects_to_google(app_client):
     r = await app_client.get(
         "/api/auth/login", follow_redirects=False