feat(router): add whitelist mechanism for http driver and auth plugin

- implement route whitelist registration and wildcard matching in RouterExtension
- add cookie store session fallback when Redis is disabled in driver_http
- actively register public auth endpoints to whitelist in auth plugin
- update user handlers to persist session and clear cookie on logout
- document router whitelist mechanism in AGENTS.md and new-api skill

backend/plugins/drivers/driver_http/config.go

@@ -18,6 +18,7 @@ type httpAppConfig struct {
 }
 
 type httpRedisConfig struct {
+	Enabled     bool     `config:"enabled" env:"REDIS_ENABLED" default:"false"`
 	Addrs       []string `config:"addrs" env:"REDIS_ADDR"`
 	Username    string   `config:"username" env:"REDIS_USERNAME"`
 	Password    string   `config:"password" env:"REDIS_PASSWORD" secret:"true"`