fix: serve datastar locally and clean up session/route config

Replace CDN-hosted datastar beta.11 with local v1.0.0-RC.7 to fix
client-side expression incompatibilities with the Go SDK. Also fix
quoted CSS class keys in data-class expressions, harden session cookie
settings (named cookie, Secure flag), simplify SetupRoutes to not
return an error, and regenerate templ output.

sessions/sessions.go

@@ -20,9 +20,10 @@ func SetupSessionManager(db *sql.DB) (*scs.SessionManager, func()) {
 	sessionManager := scs.New()
 	sessionManager.Store = store
 	sessionManager.Lifetime = 30 * 24 * time.Hour
+	sessionManager.Cookie.Name = "c4_session"
 	sessionManager.Cookie.Path = "/"
 	sessionManager.Cookie.HttpOnly = true
-	sessionManager.Cookie.Secure = false
+	sessionManager.Cookie.Secure = true
 	sessionManager.Cookie.SameSite = http.SameSiteLaxMode
 
 	slog.Info("session manager configured")