fix(security): make session-cookie hardening work under TLS termination

The passive scan flagged 3x MEDIUM 'PHPSESSID missing Secure' and an
admin-login cookie missing HttpOnly. Root cause was not the cookie code
but scheme detection: every call site read $_SERVER['HTTPS'] directly,
which is unset when TLS is terminated in front of PHP-FPM, so the Secure
flag was silently dropped.

Add RequestUtil::isSecure()/baseUrl() as the single scheme detector:
  1. $_SERVER['HTTPS'] (direct TLS)
  2. X-Forwarded-Proto — only from a loopback/private peer, so a remote
     client cannot spoof it
  3. SERVER_PORT == 443
Replace all 8 inline $_SERVER['HTTPS'] idioms (App, AdminAuth, 4x filepond
endpoints, validate-access, admin/acces, SystemController self-ping).

nginx: forward the scheme to php-fpm in all 4 fastcgi blocks
(fastcgi_param HTTPS $https + X-Forwarded-Proto $scheme) and uncomment
server_tokens off. Config validated with nginx -t (real config, alpine
container).

AdminAuth: logout() now clears the session cookie with the same
path/domain/secure/httponly/samesite it was set with, instead of the
legacy positional setcookie() that dropped SameSite.

Tests (+24, 340 total):
  - RequestUtilTest: scheme detection incl. proxy trust boundaries
  - SessionCookieTest: logout emits a hardened deletion cookie
  - PeerTubeIntegrationTest: PeerTube keeps using its absolute instance_url
    and is unaffected by scheme changes (Guzzle MockHandler)
  - NginxConfigTest: pins HTTPS forwarding, HSTS includeSubDomains,
    server_tokens off

PeerTube uses an absolute instance_url from the DB and never derives URLs
from the request, so the integration is unchanged — the regression tests
lock that invariant in.

app/src/AdminAuth.php

@@ -67,6 +67,9 @@ class AdminAuth
             return;
         }
         // Harden session cookie (item #8)
+        // Secure is always on for admin: the panel is only reachable over
+        // HTTPS in production, and the cli-server dev exception is scoped to
+        // the built-in server that cannot do TLS anyway.
         session_set_cookie_params([
             'lifetime' => self::COOKIE_LIFETIME_SECONDS,
             'path'     => '/admin',
@@ -77,6 +80,32 @@ class AdminAuth
         session_start();
     }
 
+    /**
+     * Clear the session cookie with the same attributes used to set it.
+     *
+     * A deletion cookie must repeat the original path/domain/secure/httponly
+     * (and samesite, for consistency) or browsers keep the stale cookie.
+     */
+    private static function clearSessionCookie(): void
+    {
+        if (!ini_get('session.use_cookies')) {
+            return;
+        }
+        $p = session_get_cookie_params();
+        setcookie(
+            session_name(),
+            '',
+            [
+                'expires'  => time() - 86400,
+                'path'     => $p['path'],
+                'domain'   => $p['domain'],
+                'secure'   => $p['secure'],
+                'httponly' => $p['httponly'],
+                'samesite' => $p['samesite'],
+            ]
+        );
+    }
+
     /**
      * Enforce server-side idle + absolute timeouts on an authenticated session.
      *
@@ -382,18 +411,7 @@ class AdminAuth
         }
         self::startSession();
         $_SESSION = [];
-        if (ini_get('session.use_cookies')) {
-            $p = session_get_cookie_params();
-            setcookie(
-                session_name(),
-                '',
-                time() - 86400,
-                $p['path'],
-                $p['domain'],
-                $p['secure'],
-                $p['httponly']
-            );
-        }
+        self::clearSessionCookie();
         session_destroy();
     }
 }