Cursor Security Rules for Auth Directories

Configure a .cursor/rules/security-auth.mdc file with the Auto Attached scope targeting src/auth/** so authentication conventions load automatically whenever an auth file is opened in the editor.

File: .cursor/rules/security-auth.mdc (Scope: Auto Attached on src/auth/**)

- Validate all session tokens via constant-time comparison and enforce strict HttpOnly, Secure, SameSite=Lax cookie attributes.