Complete Phase 1: goals, cookie auth, profile editing

Close the remaining Phase 1 DoD gaps and reconcile the browser flow with
the auth layer.

Goals (5 -> 7 prompts):
- Add near-term (6-12mo) and long-term (3-5yr) goal prompts; collect raw
  text on the conversation and store AI-articulated goal summaries on the
  profile. Extractor articulates the person's own stated goals (mirror,
  not compass) and never fabricates. Alembic 003 adds the four columns.

Cookie-based browser sessions (fixes frontend<->auth desync):
- OAuth callback now sets httpOnly session cookies and redirects into the
  app instead of returning JSON. get_current_user gains a cookie fallback
  (X-API-Key -> Bearer -> cookie). refresh/logout read the refresh cookie
  and set/clear cookies. New shared auth.js (authedFetch) sends cookies and
  silently refreshes on 401. Static pages drop the bogus user_id and call
  the correct /me endpoints.

Profile editing (read/edit/affirm):
- PATCH /discovery/profile/me edits the prose (Ikigai summaries, overlap
  narrative, goals); owner-scoped, partial update, 409 when locked. Edit
  mode in profile.html with Save/Cancel.

Also: bump default model to claude-sonnet-4-6, align ports to 8011
(OAuth redirect, CORS), add COOKIE_SECURE/POST_LOGIN_REDIRECT config, and
refresh the README to match the shipped behavior.

Tests: 33 passing (added cookie-auth, profile-edit, goal-extraction cases;
factored a shared app_client fixture into conftest.py).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/test_extractor.py

@@ -69,6 +69,15 @@ def make_profile_json(
                 "meet. The work that fits you lets you move first and bring "
                 "others with you."
             ),
+            "short_term_goals": (
+                "Over the next year you want to get the training program off "
+                "the ground and prove it works with a first cohort."
+            ),
+            "long_term_goals": (
+                "Within five years you see this grown into something "
+                "statewide that makes people strong enough to never need "
+                "rescuing."
+            ),
             "confidence": {
                 "triad": "high",
                 "type": "medium",
@@ -162,6 +171,38 @@ async def test_overlap_narrative_present():
         assert result["overlap_narrative"].strip() != ""
 
 
+@pytest.mark.asyncio
+async def test_goal_fields_extracted():
+    """Both goal horizons are returned and the goal prompts reach the model."""
+    responses = load_fixture("gut_type_responses.json")
+    extractor = make_extractor([make_profile_json("gut", 8, 9)])
+
+    result = await extractor.extract(responses)
+
+    assert result["short_term_goals"].strip() != ""
+    assert result["long_term_goals"].strip() != ""
+    # the goal responses were labelled and included in the prompt
+    sent = extractor.client.messages.calls[0]["messages"][0]["content"]
+    assert "Near-Term Goals (6–12 months)" in sent
+    assert "Long-Term Goals (3–5 years)" in sent
+    assert "first cohort" in sent  # short-term goal text from the fixture
+
+
+@pytest.mark.asyncio
+async def test_missing_goal_keys_trigger_retry():
+    """A profile lacking the goal fields is treated as malformed (one retry)."""
+    incomplete = json.loads(make_profile_json("head", 5, 6))
+    del incomplete["short_term_goals"]
+    del incomplete["long_term_goals"]
+    valid = make_profile_json("head", 5, 6)
+    extractor = make_extractor([json.dumps(incomplete), valid])
+
+    result = await extractor.extract(load_fixture("head_type_responses.json"))
+
+    assert result["short_term_goals"].strip() != ""
+    assert len(extractor.client.messages.calls) == 2
+
+
 @pytest.mark.asyncio
 async def test_confidence_flags_present():
     extractor = make_extractor([make_profile_json("heart", 3, 2)])