fix(security): make session-cookie hardening work under TLS termination

The passive scan flagged 3x MEDIUM 'PHPSESSID missing Secure' and an
admin-login cookie missing HttpOnly. Root cause was not the cookie code
but scheme detection: every call site read $_SERVER['HTTPS'] directly,
which is unset when TLS is terminated in front of PHP-FPM, so the Secure
flag was silently dropped.

Add RequestUtil::isSecure()/baseUrl() as the single scheme detector:
  1. $_SERVER['HTTPS'] (direct TLS)
  2. X-Forwarded-Proto — only from a loopback/private peer, so a remote
     client cannot spoof it
  3. SERVER_PORT == 443
Replace all 8 inline $_SERVER['HTTPS'] idioms (App, AdminAuth, 4x filepond
endpoints, validate-access, admin/acces, SystemController self-ping).

nginx: forward the scheme to php-fpm in all 4 fastcgi blocks
(fastcgi_param HTTPS $https + X-Forwarded-Proto $scheme) and uncomment
server_tokens off. Config validated with nginx -t (real config, alpine
container).

AdminAuth: logout() now clears the session cookie with the same
path/domain/secure/httponly/samesite it was set with, instead of the
legacy positional setcookie() that dropped SameSite.

Tests (+24, 340 total):
  - RequestUtilTest: scheme detection incl. proxy trust boundaries
  - SessionCookieTest: logout emits a hardened deletion cookie
  - PeerTubeIntegrationTest: PeerTube keeps using its absolute instance_url
    and is unaffected by scheme changes (Guzzle MockHandler)
  - NginxConfigTest: pins HTTPS forwarding, HSTS includeSubDomains,
    server_tokens off

PeerTube uses an absolute instance_url from the DB and never derives URLs
from the request, so the integration is unchanged — the regression tests
lock that invariant in.

nginx/xamxam.conf

@@ -64,8 +64,8 @@ server {
     add_header Cross-Origin-Opener-Policy "same-origin" always;
     add_header Cross-Origin-Resource-Policy "same-origin" always;
 
-    # Server tokens already disabled in nginx.conf
-    # server_tokens off;
+    # Hide nginx version in Server header and error pages.
+    server_tokens off;
 
     # Max upload size (for thesis files — can include video)
     client_max_body_size 8192M;
@@ -157,6 +157,8 @@ server {
 
             # Security parameters (must be <= client_max_body_size)
             fastcgi_param PHP_VALUE "upload_max_filesize=8192M \n post_max_size=8192M \n upload_tmp_dir=/var/www/xamxam/storage/tmp/php-uploads";
+            fastcgi_param HTTPS $https;
+            fastcgi_param HTTP_X_FORWARDED_PROTO $scheme;
 
             # Timeouts
             fastcgi_read_timeout 600;
@@ -177,6 +179,8 @@ server {
             include snippets/fastcgi-php.conf;
             fastcgi_pass unix:/var/run/php/php8.4-fpm.sock;
             fastcgi_param PHP_VALUE "upload_max_filesize=8192M \n post_max_size=8192M \n upload_tmp_dir=/var/www/xamxam/storage/tmp/php-uploads";
+            fastcgi_param HTTPS $https;
+            fastcgi_param HTTP_X_FORWARDED_PROTO $scheme;
             fastcgi_read_timeout 600;
             fastcgi_send_timeout 600;
         }
@@ -200,6 +204,8 @@ server {
         fastcgi_param SCRIPT_NAME /index.php;
         fastcgi_pass unix:/var/run/php/php8.4-fpm.sock;
         fastcgi_param PHP_VALUE "upload_max_filesize=8192M \n post_max_size=8192M \n upload_tmp_dir=/var/www/xamxam/storage/tmp/php-uploads";
+        fastcgi_param HTTPS $https;
+        fastcgi_param HTTP_X_FORWARDED_PROTO $scheme;
         fastcgi_read_timeout 600;
         fastcgi_send_timeout 600;
     }
@@ -221,6 +227,8 @@ server {
 
         # Security parameters (must be <= client_max_body_size)
         fastcgi_param PHP_VALUE "upload_max_filesize=8192M \n post_max_size=8192M \n upload_tmp_dir=/var/www/xamxam/storage/tmp/php-uploads";
+        fastcgi_param HTTPS $https;
+        fastcgi_param HTTP_X_FORWARDED_PROTO $scheme;
 
         # Timeouts
         fastcgi_read_timeout 600;