feat: implement Content-Security-Policy for admin SPA and enhance session cookie security

config/packages/framework.yaml

@@ -3,7 +3,10 @@ framework:
     secret: '%env(APP_SECRET)%'
 
     # Note that the session will be started ONLY if you read or write from it.
-    session: true
+    session:
+        cookie_secure: true       # HTTPS only (ddev + prod behind Traefik are both HTTPS)
+        cookie_samesite: lax      # blunt CSRF on stateful surfaces (e.g. Twig payment pages)
+        cookie_httponly: true
 
     # Behind Coolify/Traefik reverse proxy. TRUSTED_PROXIES is empty by default
     # (local/ddev) and set to the Docker network range in production.

config/reference.php

@@ -1239,9 +1239,9 @@ use Symfony\Component\Config\Loader\ParamConfigurator as Param;
  *             lifetime?: int|Param, // Default: 31536000
  *             path?: scalar|Param|null, // Default: "/"
  *             domain?: scalar|Param|null, // Default: null
- *             secure?: true|false|"auto"|Param, // Default: false
+ *             secure?: true|false|"auto"|Param, // Default: true
  *             httponly?: bool|Param, // Default: true
- *             samesite?: null|"lax"|"strict"|"none"|Param, // Default: null
+ *             samesite?: null|"lax"|"strict"|"none"|Param, // Default: "lax"
  *             always_remember_me?: bool|Param, // Default: false
  *             remember_me_parameter?: scalar|Param|null, // Default: "_remember_me"
  *         },