fix(remote): keep each session cookie's domain, path and secure flag

The client set server cookies with no domain and sent all of them to every host, so a CDN refused segment requests with 400 header too large. rnet sessions now send cookies too.

docs/dev/rest-api/endpoints.md

@@ -1096,6 +1096,7 @@ Get tracks and chapters for a specific title within the remote session. Body: `{
       "track_manifests": [ { "track_id": "s-1", "type": "dash", "url": "https://...", "data": "<base64 zlib xml>" } ],
       "session_headers": { "User-Agent": "..." },
       "session_cookies": { "sid": "..." },
+      "session_cookie_jar": [ { "name": "sid", "value": "...", "domain": ".example.com", "path": "/", "secure": true } ],
       "server_cdm_type": "widevine"
     }
     ```
@@ -1115,11 +1116,13 @@ Get the download URL, DRM info, headers, cookies, and raw track data for the sel
     ```json
     {
       "tracks": {
-        "v-1": { "descriptor": "DASH", "url": "https://...", "drm": [ ... ], "headers": { ... }, "cookies": { ... }, "data": { ... } }
+        "v-1": { "descriptor": "DASH", "url": "https://...", "drm": [ ... ], "headers": { ... }, "cookies": { ... }, "cookie_jar": [ ... ], "data": { ... } }
       }
     }
     ```
 
+`cookies` gives names and values only. `cookie_jar` gives the same cookies with their domain, path and `secure` flag, in the `session_cookie_jar` form of the tracks response.
+
 | Status | Error code | Meaning |
 | --- | --- | --- |
 | `200` | - | Segment info returned. |

docs/dev/rest-api/remote-sessions.md

@@ -214,8 +214,10 @@ hood the client walks a remote session through its lifecycle.
     downloading. A service can build an AdaptationSet of its own that the served
     manifest does not contain. Each such track gets a one-AdaptationSet MPD in
     `track_manifests`, and the client re-parses that instead. Any
-    `session_headers` / `session_cookies` the server used are merged into the
-    client's local HTTP session.
+    `session_headers` and cookies the server used are merged into the
+    client's local HTTP session. Each cookie in `session_cookie_jar` keeps its
+    domain, path and `secure` flag, so it goes only to its own hosts. `session_cookies` carries
+    the same cookies as names and values only, for older clients.
 
     The tracks response repeats the title. A service can rewrite title fields inside
     `get_tracks`, so the client takes this copy in place of the one from the title
@@ -653,7 +655,7 @@ remote session API and a good template for any client.
 - **Flow.** `authenticate()` → `create` (+ poll `prompt` every 2s up to a 600s
   deadline, answering `pending_input` prompts. With stdin closed the client logs an
   error and raises `SystemExit(1)` instead of posting an empty answer) → `get_titles()` → `get_tracks()`
-  (merging returned `session_headers`/`session_cookies`, re-parsing `manifests`) →
+  (merging returned `session_headers`/`session_cookie_jar`, re-parsing `manifests`) →
   get the licence in proxy mode or `server_cdm` mode → `close()` (`DELETE`, saving any returned
   `cache`).
 - **Server resolution.** `resolve_server()` reads `config.remote_services.<name>`