Fix: Session cookies for iframe embedding (Chrome, Edge, etc.)

Critical fix for HF Spaces iframe embedding:
- Set SESSION_COOKIE_SAMESITE='None' to allow cookies in iframes
- Set SESSION_COOKIE_SECURE=True for HTTPS (required with SameSite=None)
- Set PERMANENT_SESSION_LIFETIME to 24 hours
- Add SESSION_COOKIE_HTTPONLY for security

Fixes login issues where users enter token but page just reloads.
Chrome, Edge, and other browsers block third-party cookies by default
in iframes unless SameSite=None is set.

app/__init__.py

@@ -11,6 +11,12 @@ def create_app():
     app = Flask(__name__)
     app.config['SECRET_KEY'] = os.getenv('FLASK_SECRET_KEY', 'dev-secret-key-change-in-production')
 
+    # Session configuration for iframe embedding (HF Spaces)
+    app.config['SESSION_COOKIE_SECURE'] = True  # Required for HTTPS
+    app.config['SESSION_COOKIE_HTTPONLY'] = True  # Security
+    app.config['SESSION_COOKIE_SAMESITE'] = 'None'  # Allow in iframes
+    app.config['PERMANENT_SESSION_LIFETIME'] = 86400  # 24 hours
+
     # Use custom database path if set (for HF Spaces), otherwise use instance folder
     db_path = os.getenv('DATABASE_PATH')
     if db_path: