kk-test-auth — secure HttpOnly cookie test harness

Frontend and API are same-origin. Cookies are HttpOnly and intentionally invisible to JavaScript. This page never reads document.cookie. Auth is verified only via GET /api/v3/me.
Advanced (debug only): override API base URL
idle