feat(router): add whitelist mechanism for http driver and auth plugin

- implement route whitelist registration and wildcard matching in RouterExtension
- add cookie store session fallback when Redis is disabled in driver_http
- actively register public auth endpoints to whitelist in auth plugin
- update user handlers to persist session and clear cookie on logout
- document router whitelist mechanism in AGENTS.md and new-api skill

backend/plugins/domain/user/handlers.go

@@ -79,7 +79,9 @@ func Login(c *gin.Context) {
 	sess := sessions.Default(c)
 	sess.Set(contracts.AuthUserIDKey, user.ID)
 	sess.Set(contracts.AuthUserNameKey, user.Username)
-	_ = sess.Save()
+	if err := sess.Save(); err != nil {
+		logger.ErrorF(c.Request.Context(), "save session failed on login: %v", err)
+	}
 
 	c.JSON(http.StatusOK, response.OK(user))
 }
@@ -107,14 +109,27 @@ func Register(c *gin.Context) {
 		return
 	}
 
+	sess := sessions.Default(c)
+	sess.Set(contracts.AuthUserIDKey, newUser.ID)
+	sess.Set(contracts.AuthUserNameKey, newUser.Username)
+	if err := sess.Save(); err != nil {
+		logger.ErrorF(c.Request.Context(), "save session failed on register: %v", err)
+	}
+
 	c.JSON(http.StatusOK, response.OK(newUser))
 }
 
 // Logout logs out the current session.
 func Logout(c *gin.Context) {
 	sess := sessions.Default(c)
+	sess.Options(sessions.Options{
+		Path:   "/",
+		MaxAge: -1,
+	})
 	sess.Clear()
-	_ = sess.Save()
+	if err := sess.Save(); err != nil {
+		logger.ErrorF(c.Request.Context(), "clear session failed on logout: %v", err)
+	}
 	c.JSON(http.StatusOK, response.OKNil())
 }