fix: TLS verification, cookie hardening, and proxy transport (#7)

- Renamed _ssl_ctx to _internal_ssl_ctx (explicitly scoped to internal services)
- Image proxy now uses default SSL context (TLS verification enabled for external URLs)
- Logout cookie clearing now includes HttpOnly, Secure, SameSite=Lax
- proxy.py still uses internal context (Docker services have no valid certs)

Closes #7

gateway/auth.py

@@ -58,7 +58,7 @@ def handle_logout(handler):
     delete_session(token)
     handler.send_response(200)
     handler.send_header("Content-Type", "application/json")
-    handler.send_header("Set-Cookie", "platform_session=; Path=/; Max-Age=0")
+    handler.send_header("Set-Cookie", "platform_session=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0")
     resp = b'{"success": true}'
     handler.send_header("Content-Length", len(resp))
     handler.end_headers()