fix(api): drop redundant dev-deps; fix server AppState for cookie_secure; add logout + illegal-transition tests

crates/server/src/lib.rs

@@ -20,6 +20,8 @@ pub async fn run(config: Config) -> anyhow::Result<()> {
     let state = AppState {
         db,
         app_name: config.app_name.clone(),
+        // Wired to config in the auth CLI task; Secure by default.
+        cookie_secure: true,
     };
 
     let listener = TcpListener::bind(&config.bind_addr)

crates/server/tests/serve.rs

@@ -15,6 +15,7 @@ async fn serves_health_live_over_tcp() {
     let state = AppState {
         db,
         app_name: "Test".to_string(),
+        cookie_secure: false,
     };
 
     let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();