fix: login loop and repeated medication notifications

- Fix login loop: secure cookie detection now uses x-forwarded-proto/origin
  headers to correctly identify HTTPS requests through Tailscale Funnel
- Add credentials: include to login/register fetch calls
- Verify session after login/registration before redirecting to prevent race conditions
- Fix repeated medication reminders: isDue() now matches exact minute instead of
  5-minute tolerance window, preventing duplicate notifications when sender runs
  every minute
- Add tests for cookie security and notification scheduling
- Extract isDue() to separate module for better testability

src/app/api/auth/register/route.ts

@@ -49,7 +49,11 @@ async function handler(req: NextRequest) {
     const userAgent = req.headers.get('user-agent') || undefined
     const ipAddress = req.headers.get('x-forwarded-for')?.split(',')[0]
     const token = await createSession(user.id, userAgent, ipAddress)
-    const cookieConfig = getSessionCookieConfig(token)
+    const cookieConfig = getSessionCookieConfig(token, {
+      forwardedProto: req.headers.get('x-forwarded-proto'),
+      origin: req.headers.get('origin'),
+      referer: req.headers.get('referer'),
+    })
 
     const response = NextResponse.json({
       user,