Harden UI: login brute-force throttle, security headers, Secure cookie flag

- New in-memory login throttle (handler/login_throttle.go): 5 failed
  attempts per IP or per username within 5 minutes locks that key out for
  5 minutes, applied to both /login and the TOTP verification step, which
  previously had no rate limiting at all
- router.New now adds middleware.Secure with X-Frame-Options,
  X-Content-Type-Options, Referrer-Policy, and HSTS (only when cookies
  are Secure, implying an HTTPS deployment). No CSP: the existing
  templates rely on inline <script> blocks, so a CSP strict enough to
  matter would need 'unsafe-inline' anyway
- All session/auth cookies now set Secure based on the new
  --cookie-secure flag / WGUI_COOKIE_SECURE env var (default true) so the
  session cookie is never sent over plain HTTP unless explicitly opted
  into an HTTP-only LAN deployment

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ATVUwTa4Pqwq26orW5BcDW

util/config.go

@@ -28,6 +28,10 @@ var (
 	BasePath           string
 	SubnetRanges       map[string]([]*net.IPNet)
 	SubnetRangesOrder  []string
+	// CookieSecure sets the Secure flag on the session cookie, so browsers
+	// never send it over plain HTTP. Defaults to true; only disable it for
+	// a deliberately HTTP-only LAN deployment (see COOKIE_SECURE_ENV_VAR).
+	CookieSecure bool
 )
 
 const (
@@ -70,6 +74,7 @@ const (
 	DefaultClientExtraAllowedIpsEnvVar     = "WGUI_DEFAULT_CLIENT_EXTRA_ALLOWED_IPS"
 	DefaultClientUseServerDNSEnvVar        = "WGUI_DEFAULT_CLIENT_USE_SERVER_DNS"
 	DefaultClientEnableAfterCreationEnvVar = "WGUI_DEFAULT_CLIENT_ENABLE_AFTER_CREATION"
+	CookieSecureEnvVar                     = "WGUI_COOKIE_SECURE"
 )
 
 func ParseBasePath(basePath string) string {