security: fix issues #1-4 from security audit

#1 Session cookie: add secure (production-only) and sameSite=strict
    to prevent transmission over HTTP and cross-site request abuse.
#2 Remove Emby AccessToken from cookie payload — it was stored in
    the browser cookie but is never needed client-side; reduces blast
    radius if cookie is ever exposed.
#3 Add requireAuth middleware to all proxy routes (/api/emby,
    /api/sabnzbd, /api/sonarr, /api/radarr) — previously unauthenticated,
    now require a valid emby_user session cookie.
#4 Remove open CORS wildcard (cors() with no options). The frontend
    is served from the same origin so no CORS headers are required.
    Also update clearCookie() to include matching cookie options.

server/middleware/requireAuth.js

@@ -0,0 +1,14 @@
+function requireAuth(req, res, next) {
+  const userCookie = req.cookies.emby_user;
+  if (!userCookie) {
+    return res.status(401).json({ error: 'Not authenticated' });
+  }
+  try {
+    req.user = JSON.parse(userCookie);
+  } catch {
+    return res.status(401).json({ error: 'Invalid session' });
+  }
+  next();
+}
+
+module.exports = requireAuth;