Complete Phase 1: goals, cookie auth, profile editing

Close the remaining Phase 1 DoD gaps and reconcile the browser flow with
the auth layer.

Goals (5 -> 7 prompts):
- Add near-term (6-12mo) and long-term (3-5yr) goal prompts; collect raw
  text on the conversation and store AI-articulated goal summaries on the
  profile. Extractor articulates the person's own stated goals (mirror,
  not compass) and never fabricates. Alembic 003 adds the four columns.

Cookie-based browser sessions (fixes frontend<->auth desync):
- OAuth callback now sets httpOnly session cookies and redirects into the
  app instead of returning JSON. get_current_user gains a cookie fallback
  (X-API-Key -> Bearer -> cookie). refresh/logout read the refresh cookie
  and set/clear cookies. New shared auth.js (authedFetch) sends cookies and
  silently refreshes on 401. Static pages drop the bogus user_id and call
  the correct /me endpoints.

Profile editing (read/edit/affirm):
- PATCH /discovery/profile/me edits the prose (Ikigai summaries, overlap
  narrative, goals); owner-scoped, partial update, 409 when locked. Edit
  mode in profile.html with Save/Cancel.

Also: bump default model to claude-sonnet-4-6, align ports to 8011
(OAuth redirect, CORS), add COOKIE_SECURE/POST_LOGIN_REDIRECT config, and
refresh the README to match the shipped behavior.

Tests: 33 passing (added cookie-auth, profile-edit, goal-extraction cases;
factored a shared app_client fixture into conftest.py).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/test_static_discovery.py

@@ -1,9 +1,41 @@
 from pathlib import Path
 
 
-def test_discovery_page_has_insecure_context_uuid_fallback():
+def test_discovery_page_uses_cookie_session_not_user_id():
+    """The browser session is a server-set cookie, so the page must not mint
+    or carry a client-side user id, and all calls go through authedFetch."""
     html = Path("app/static/discovery.html").read_text(encoding="utf-8")
 
-    assert "function createUserId()" in html
-    assert "crypto.randomUUID()" not in html
-    assert "getRandomValues" in html
+    assert "impactflow_user_id" not in html
+    assert "createUserId" not in html
+    assert "user_id" not in html
+    assert "authedFetch" in html
+    assert '/static/auth.js' in html
+
+
+def test_profile_page_uses_me_endpoints_and_authed_fetch():
+    """Profile reads/confirms via the user-scoped /me routes, authenticated by
+    the session cookie through authedFetch — not the old user_id-in-URL paths."""
+    html = Path("app/static/profile.html").read_text(encoding="utf-8")
+
+    assert "/discovery/profile/me" in html
+    assert "/discovery/profile/me/confirm" in html
+    assert "user_id" not in html
+    assert "authedFetch" in html
+
+
+def test_profile_page_has_edit_affordance():
+    """The read/edit/affirm DoD: an Edit control that PATCHes the profile."""
+    html = Path("app/static/profile.html").read_text(encoding="utf-8")
+
+    assert "renderEdit" in html
+    assert 'method: "PATCH"' in html
+    assert "Edit my words" in html
+
+
+def test_auth_helper_sends_credentials_and_refreshes():
+    js = Path("app/static/auth.js").read_text(encoding="utf-8")
+
+    assert 'credentials: "include"' in js
+    assert "/api/auth/refresh" in js
+    assert "/api/auth/login" in js