Redirect loop fix

The redirect loop was caused by the Manager cookie configuration:
1. secure was based on NODE_ENV=production, so HTTP deployments silently dropped the cookie.
2. Path=/manager excluded /api/manager/*, preventing authenticated Manager API requests.

src/services/management/management-auth.ts

@@ -1,5 +1,6 @@
 import { createHmac, timingSafeEqual } from "node:crypto";
 import { cookies } from "next/headers";
+import { isSecureDeployment } from "@/lib/security/cookie-security";
 import { getManagerConfig } from "./manager-config";
 
 const COOKIE_NAME = "nextchair_manager_session";
@@ -27,8 +28,10 @@ export async function createManagerSession() {
   (await cookies()).set(COOKIE_NAME, `${value}.${signature(value, config.authSecret)}`, {
     httpOnly: true,
     sameSite: "strict",
-    secure: process.env.NODE_ENV === "production",
-    path: "/manager",
+    secure: isSecureDeployment(),
+    // The Manager UI is under /manager, but its authenticated API is under
+    // /api/manager, so the cookie must cover both paths.
+    path: "/",
     maxAge: 60 * 60 * 8,
   });
 }