security: Secure cookie flag (ANIWEB_SECURE, on in run.sh) + kill sessions of deleted accounts

- middleware re-verifies the username against users.json per request:
  deleted accounts' signed cookies are rejected immediately
- set_cookie/delete_cookie honor the Secure flag; run.sh sets
  ANIWEB_SECURE=1 so sessions only work through the HTTPS proxy

run.sh

@@ -3,5 +3,7 @@
 cd "$(dirname "$0")" || exit 1
 [ -x .venv/bin/python ] || { echo "no .venv — run: uv venv .venv && uv pip install --python .venv/bin/python -r requirements.txt"; exit 1; }
 pkill -f "uvicorn .*app:app" 2>/dev/null; sleep 1
-nohup .venv/bin/python -m uvicorn server.app:app --host 0.0.0.0 --port 8321 > server.log 2>&1 &
-echo "ani-web on http://localhost:8321 (pid $!)"
+# ANIWEB_SECURE=1: session cookie is Secure — only usable via the HTTPS
+# proxy (plain http://<this machine>:8321 can no longer hold a session).
+ANIWEB_SECURE=1 nohup .venv/bin/python -m uvicorn server.app:app --host 0.0.0.0 --port 8321 > server.log 2>&1 &
+echo "ani-web on http://localhost:8321 (pid $!) — use the HTTPS proxy to log in"