docs: clarify HttpOnly cookie guidance - #265

Summary

• Clarify that browser JavaScript cannot set or read HttpOnly cookies and that real session cookies must be issued and verified server-side.
• Explain that the React Vite MSW auth handler uses js-cookie as a test workaround, not as a production security pattern.
• Replace overbroad token-storage guidance with the actual memory, browser-storage, and cookie tradeoffs.

Validation

• git diff --check passed.
• Documentation-only change; no application tests run.