feat(auth): add signed app_meta cookie with role and onboarding status

[Nirbhay21]

Summary

This PR introduces a signed app_meta cookie to keep frontend state in sync with
user role and onboarding completion status. It also strengthens onboarding
validation logic and adds PATCH support in CORS configuration.

Scope

Auth

• getMe now:
  • Fetches onboarding status
  • Sets signed app_meta cookie (role + onboarding complete flag)
  • Returns onboardingStatus in response

Onboarding

• getOnboardingStatus updates signed meta cookie
• completeOnboarding:
  • Accepts onboardingData, currentStep, onboardingType
  • Validates role consistency
  • Validates step range (1–3)
  • Updates meta cookie after completion
• updateStatus now strictly enforces onboardingType === user role

Security / Validation

• Added SECRET_KEY to env schema
• Centralized parseUserRole helper
• Prevents role spoofing during onboarding updates

Infrastructure

• Enabled PATCH in CORS config