fix(security): make session-cookie hardening work under TLS termination

The passive scan flagged 3x MEDIUM 'PHPSESSID missing Secure' and an
admin-login cookie missing HttpOnly. Root cause was not the cookie code
but scheme detection: every call site read $_SERVER['HTTPS'] directly,
which is unset when TLS is terminated in front of PHP-FPM, so the Secure
flag was silently dropped.

Add RequestUtil::isSecure()/baseUrl() as the single scheme detector:
  1. $_SERVER['HTTPS'] (direct TLS)
  2. X-Forwarded-Proto — only from a loopback/private peer, so a remote
     client cannot spoof it
  3. SERVER_PORT == 443
Replace all 8 inline $_SERVER['HTTPS'] idioms (App, AdminAuth, 4x filepond
endpoints, validate-access, admin/acces, SystemController self-ping).

nginx: forward the scheme to php-fpm in all 4 fastcgi blocks
(fastcgi_param HTTPS $https + X-Forwarded-Proto $scheme) and uncomment
server_tokens off. Config validated with nginx -t (real config, alpine
container).

AdminAuth: logout() now clears the session cookie with the same
path/domain/secure/httponly/samesite it was set with, instead of the
legacy positional setcookie() that dropped SameSite.

Tests (+24, 340 total):
  - RequestUtilTest: scheme detection incl. proxy trust boundaries
  - SessionCookieTest: logout emits a hardened deletion cookie
  - PeerTubeIntegrationTest: PeerTube keeps using its absolute instance_url
    and is unaffected by scheme changes (Guzzle MockHandler)
  - NginxConfigTest: pins HTTPS forwarding, HSTS includeSubDomains,
    server_tokens off

PeerTube uses an absolute instance_url from the DB and never derives URLs
from the request, so the integration is unchanged — the regression tests
lock that invariant in.

tests/phpunit/SessionCookieTest.php

@@ -0,0 +1,118 @@
+<?php
+
+use PHPUnit\Framework\TestCase;
+
+/**
+ * SessionCookieTest — regression guard for the session cookie hardening that
+ * the passive security scan flagged (PHPSESSID missing Secure / HttpOnly).
+ *
+ * Root cause was two-fold:
+ *   1. Scheme detection used $_SERVER['HTTPS'] directly, which is unset under
+ *      reverse-proxy TLS termination → Secure silently dropped.
+ *   2. AdminAuth::logout() emitted a deletion cookie without SameSite (and with
+ *      the legacy positional signature), so the stale cookie could linger.
+ *
+ * Uses xdebug_get_headers() to inspect the emitted Set-Cookie header.
+ */
+class SessionCookieTest extends TestCase
+{
+    protected function setUp(): void
+    {
+        if (!function_exists('xdebug_get_headers')) {
+            $this->markTestSkipped('xdebug required to inspect headers');
+        }
+        // Reset any session left over from another test.
+        if (session_status() === PHP_SESSION_ACTIVE) {
+            $_SESSION = [];
+            session_destroy();
+        }
+        if (!headers_sent()) {
+            header_remove();
+        }
+    }
+
+    protected function tearDown(): void
+    {
+        if (session_status() === PHP_SESSION_ACTIVE) {
+            $_SESSION = [];
+            session_destroy();
+        }
+    }
+
+    /** Every Set-Cookie emitted must carry Secure+HttpOnly+SameSite. */
+    private function assertHardenedSetCookie(string $header): void
+    {
+        $this->assertStringContainsStringIgnoringCase('HttpOnly', $header, $header);
+        $this->assertStringContainsStringIgnoringCase('Secure', $header, $header);
+        $this->assertStringContainsStringIgnoringCase('SameSite', $header, $header);
+    }
+
+    /** Start an admin session exactly the way the panel does. */
+    private function startAdminSession(): void
+    {
+        $_SERVER['REMOTE_ADDR'] = '127.0.0.1';
+        // Simulate production: TLS terminated by a trusted proxy, so
+        // $_SERVER['HTTPS'] is absent and only X-Forwarded-Proto is set.
+        unset($_SERVER['HTTPS']);
+        $_SERVER['HTTP_X_FORWARDED_PROTO'] = 'https';
+
+        // AdminAuth::startSession() is private; logout() calls it first.
+        // Seed the session directly with the same params it applies.
+        session_set_cookie_params([
+            'lifetime' => 604800,
+            'path'     => '/admin',
+            'secure'   => true,
+            'httponly' => true,
+            'samesite' => 'Strict',
+        ]);
+        session_start();
+        $_SESSION['admin_authenticated'] = true;
+    }
+
+    public function testLogoutEmitsHardenedDeletionCookie(): void
+    {
+        $this->startAdminSession();
+        header_remove();
+
+        AdminAuth::logout();
+
+        $headers = xdebug_get_headers();
+        $cookies = array_values(array_filter(
+            $headers,
+            static fn (string $h): bool => stripos($h, 'Set-Cookie:') === 0
+                && stripos($h, 'PHPSESSID') !== false
+        ));
+
+        $this->assertNotEmpty($cookies, 'logout must clear the session cookie');
+        foreach ($cookies as $header) {
+            $this->assertHardenedSetCookie($header);
+            // Deletion requires an expiry in the past.
+            $this->assertMatchesRegularExpression('/expires=.*(1981|1970)/i', $header, $header);
+        }
+    }
+
+    public function testLogoutIsNoOpWhenNoSession(): void
+    {
+        // No active session — logout() must return quietly, not fatal.
+        $this->assertSame(PHP_SESSION_NONE, session_status());
+        AdminAuth::logout();
+        $this->assertSame(PHP_SESSION_NONE, session_status());
+    }
+
+    /**
+     * The Secure flag must be driven by RequestUtil (proxy-aware), not by the
+     * raw $_SERVER['HTTPS'] idiom that regressed in production.
+     */
+    public function testSecureDetectionUnderProxyTermination(): void
+    {
+        $this->assertTrue(RequestUtil::isSecure([
+            'REMOTE_ADDR'            => '127.0.0.1',
+            'HTTP_X_FORWARDED_PROTO' => 'https',
+        ]));
+
+        $this->assertFalse(RequestUtil::isSecure([
+            'REMOTE_ADDR'            => '203.0.113.7',
+            'HTTP_X_FORWARDED_PROTO' => 'https',
+        ]));
+    }
+}