Allow admin session cookies on HTTP so Payload login works without HTTPS.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/cms/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moniki/cms",
-  "version": "1.0.6",
+  "version": "1.0.7",
   "private": true,
   "type": "module",
   "scripts": {

apps/cms/src/collections/Users.ts

@@ -8,7 +8,8 @@ export const Users: CollectionConfig = {
     tokenExpiration: 60 * 60 * 24 * 7,
     cookies: {
       sameSite: 'Lax',
-      secure: process.env.NODE_ENV === 'production',
+      // HTTP admin (IP:3001) cannot store Secure cookies; enable only on HTTPS.
+      secure: (process.env.NEXT_PUBLIC_SERVER_URL || '').startsWith('https://'),
     },
   },
   admin: {

apps/web/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moniki/web",
-  "version": "1.0.6",
+  "version": "1.0.7",
   "private": true,
   "scripts": {
     "dev": "next dev -p 3000",