feat(auth): rename session cookie to nanodrop_session

Flips SESSION_COOKIE_NAME from 'token' to 'nanodrop_session' per the
family per-app naming convention (<app>_session). fastify-jwt's
cookieName in server.ts is now sourced from the constant so a future
rename only needs to touch constants.ts.

Hard-cut migration with no dual-cookie shim: the existing 'token'
cookie has no Max-Age so it dies on browser close anyway, and this
is a single-user deployment per CLAUDE.md. Users re-log in once
after deploy.

Test files updated mechanically: cookies: { token } → cookies: {
nanodrop_session: token } (variable name 'token' kept locally),
clearCookie regex updated, login response now also asserts
Max-Age=2592000 from the family TTL.

tests/integration/files-api.test.ts

@@ -23,7 +23,7 @@ describe('GET /api/v1/files', () => {
     const res = await ctx.app.inject({
       method: 'GET',
       url: '/api/v1/files',
-      cookies: { token },
+      cookies: { nanodrop_session: token },
     });
     expect(res.statusCode).toBe(200);
     expect(res.json().files).toEqual([]);
@@ -55,7 +55,7 @@ describe('POST /api/v1/files', () => {
     const res = await ctx.app.inject({
       method: 'POST',
       url: '/api/v1/files',
-      cookies: { token },
+      cookies: { nanodrop_session: token },
       ...buildMultipart({ file: { filename: 'test.txt', contentType: 'text/plain', data: Buffer.from('hello') } }),
     });
     expect(res.statusCode).toBe(201);
@@ -84,7 +84,7 @@ describe('DELETE /api/v1/files/:id', () => {
     const uploadRes = await ctx.app.inject({
       method: 'POST',
       url: '/api/v1/files',
-      cookies: { token },
+      cookies: { nanodrop_session: token },
       ...buildMultipart({ file: { filename: 'f.txt', contentType: 'text/plain', data: Buffer.from('data') } }),
     });
     fileId = uploadRes.json().file.id;
@@ -99,7 +99,7 @@ describe('DELETE /api/v1/files/:id', () => {
     const res = await ctx.app.inject({
       method: 'DELETE',
       url: `/api/v1/files/${fileId}`,
-      cookies: { token },
+      cookies: { nanodrop_session: token },
     });
     expect(res.statusCode).toBe(200);
   });
@@ -108,7 +108,7 @@ describe('DELETE /api/v1/files/:id', () => {
     const res = await ctx.app.inject({
       method: 'DELETE',
       url: '/api/v1/files/doesnotexist',
-      cookies: { token },
+      cookies: { nanodrop_session: token },
     });
     expect(res.statusCode).toBe(404);
   });