fix: audit round 2 — session cookie Secure kondisional, logout clear cookie, IDOR report owner-scoping (migrasi 0008), health force login-gate, SSE stream login-gate, FE: Gate undefined-flicker, auth-expired global redirect, X-User-Key demo dihapus, error handling alerts/routines/watchlist, chart label, encodeURIComponent, Screener onMount

backend/internal/api/api_test.go

@@ -66,7 +66,7 @@ func TestBriefing(t *testing.T) {
 	if rec.Code == http.StatusNotFound {
 		// No briefing yet: run the routine via engine path instead.
 		u, _ := s.DB.CheckLocalUser("tester", "password1234")
-	rows, _ := s.DB.ListRoutines(u.UserKey)
+		rows, _ := s.DB.ListRoutines(u.UserKey)
 		if len(rows) == 0 {
 			t.Fatal("seed has no routines")
 		}