security: Secure cookie flag (ANIWEB_SECURE, on in run.sh) + kill sessions of deleted accounts

- middleware re-verifies the username against users.json per request:
  deleted accounts' signed cookies are rejected immediately
- set_cookie/delete_cookie honor the Secure flag; run.sh sets
  ANIWEB_SECURE=1 so sessions only work through the HTTPS proxy

README.md

@@ -25,6 +25,12 @@ Account management (no self-signup by design):
 .venv/bin/python -m server.users list          # list users
 ```
 
+Security: passwords are PBKDF2-SHA256 (210k iters, per-user salts) in
+`server/data/users.json` (0600). Sessions are signed 30-day `HttpOnly`
+`SameSite=Lax` cookies; `run.sh` sets `ANIWEB_SECURE=1` so cookies are
+`Secure` and only work through your HTTPS proxy. Accounts deleted via
+the app or CLI are rejected immediately, even with an old cookie.
+
 ## Features
 
 - Per-user accounts (CLI-created, no self-signup): 30-day signed