Implement token-based admin login and remove WebAuthn support

src/lib/auth.ts

@@ -50,18 +50,22 @@ export function cleanExpiredSessions(): void {
   db.prepare(
     `DELETE FROM admin_sessions WHERE expires_at <= strftime('%Y-%m-%dT%H:%M:%SZ', 'now')`
   ).run();
-  db.prepare(
-    `DELETE FROM webauthn_challenges WHERE expires_at <= strftime('%Y-%m-%dT%H:%M:%SZ', 'now')`
-  ).run();
 }
 
 export const SESSION_COOKIE = 'admin_session';
-export const CHALLENGE_COOKIE = 'webauthn_challenge';
+
+function shouldUseSecureCookies(): boolean {
+  const secureOverride = process.env.COOKIE_SECURE?.trim().toLowerCase();
+  if (secureOverride === 'true') return true;
+  if (secureOverride === 'false') return false;
+
+  return process.env.NODE_ENV === 'production';
+}
 
 export function sessionCookieOptions(maxAge: number) {
   return {
     httpOnly: true,
-    secure: process.env.NODE_ENV === 'production',
+    secure: shouldUseSecureCookies(),
     sameSite: 'strict' as const,
     path: '/',
     maxAge,