feat(router): add whitelist mechanism for http driver and auth plugin

- implement route whitelist registration and wildcard matching in RouterExtension
- add cookie store session fallback when Redis is disabled in driver_http
- actively register public auth endpoints to whitelist in auth plugin
- update user handlers to persist session and clear cookie on logout
- document router whitelist mechanism in AGENTS.md and new-api skill

backend/core/scoped_extpoints.go

@@ -93,6 +93,18 @@ func (s *scopedRouterExtension) UnregisterByID(id uint64) bool {
 	return s.underlying.UnregisterByID(id)
 }
 
+func (s *scopedRouterExtension) RegisterWhitelist(patterns ...string) {
+	s.underlying.RegisterWhitelist(patterns...)
+}
+
+func (s *scopedRouterExtension) Whitelist() []string {
+	return s.underlying.Whitelist()
+}
+
+func (s *scopedRouterExtension) IsWhitelisted(path string) bool {
+	return s.underlying.IsWhitelisted(path)
+}
+
 // scopedTaskExtension wraps a TaskExtension to automatically register
 // teardown disposers on the associated Context when task handlers are declared.
 type scopedTaskExtension struct {