hoàn thành docker compose giai đoạn 1

backend/app/routers/auth.py

@@ -1,5 +1,6 @@
 from fastapi import APIRouter, Depends, HTTPException, Response, status
 from sqlalchemy.orm import Session
+import os
 
 from ..database import get_db
 from ..dependencies import get_current_user
@@ -16,6 +17,7 @@ router = APIRouter(prefix="/auth", tags=["auth"])
 
 _COOKIE_NAME = "access_token"
 _COOKIE_MAX_AGE = ACCESS_TOKEN_EXPIRE_MINUTES * 60   # seconds
+_COOKIE_SECURE = os.getenv("COOKIE_SECURE", "false").lower() == "true"
 
 
 def _set_auth_cookie(response: Response, user_id: int) -> None:
@@ -24,7 +26,7 @@ def _set_auth_cookie(response: Response, user_id: int) -> None:
         key=_COOKIE_NAME,
         value=token,
         httponly=True,
-        secure=True,        # send only over HTTPS (Nginx handles TLS in prod)
+        secure=_COOKIE_SECURE,
         samesite="lax",
         max_age=_COOKIE_MAX_AGE,
         path="/",