feat(router): add whitelist mechanism for http driver and auth plugin

- implement route whitelist registration and wildcard matching in RouterExtension
- add cookie store session fallback when Redis is disabled in driver_http
- actively register public auth endpoints to whitelist in auth plugin
- update user handlers to persist session and clear cookie on logout
- document router whitelist mechanism in AGENTS.md and new-api skill

backend/plugins/drivers/driver_http/plugin.go

@@ -177,12 +177,13 @@ func (p *Plugin) Start(ctx context.Context) error {
 		var err error
 		p.engine, err = BuildEngineWithConfig(appCfg, redisCfg)
 		if err != nil {
-			p.engine = gin.New()
+			p.engine, _ = BuildEngine()
 		}
 	}
 
 	// Mount routes collected in Context RouterExtension
 	if p.coreCtx != nil && p.coreCtx.Router() != nil {
+		SetWhitelist(p.coreCtx.Router().Whitelist())
 		for _, rd := range p.coreCtx.Router().Routes() {
 			allHandlers := make([]gin.HandlerFunc, 0, len(rd.Middlewares)+len(rd.Handlers))